{ "Event": { "published": true, "date": "2025-12-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-03", "timestamp": 1764806582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4a5b24ac-0d64-400d-b506-b376c5c57954", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebe13aa-d065-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764779290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779290, "uuid": "8cf1bcb8-71bb-46a1-ad96-a757e5e80755", "comment": "Malware payload (Socks5Systemz)", "value": "d83a237e3bbc8eab7d3441f77b8ab207", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779290, "uuid": "3d744834-f595-4412-b834-49003d96988a", "comment": "Malware payload (Socks5Systemz)", "value": "00e86c3eb762787af1d986f28e2b154ff5ba3c0828bd7a5bf0df1a69db739026", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779290, "uuid": "09f75813-b075-4595-87d5-829dbe5c4773", "comment": "Malware payload (Socks5Systemz)", "value": "508af35c54f5b3291e35b9b0824fcf0a3c6d0ced", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779290, "uuid": "f9fb2920-4e9c-4fbd-9215-699e812e03c8", "comment": "Malware payload (Socks5Systemz)", "value": "3f1a7684bbe3dfbc4453ee385b63a0ff8c84801bbcb1151e10142c2e18476ee0c73029f9573af701ef132d614877dd15", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779290, "uuid": "b5540382-29e4-4c84-bcc0-e27b1e59ffe3", "value": "T1B8F5332BE7446634CC71A3769EC127A2826A775924B4F877223CC83C75E7347E1A523B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779290, "uuid": "72109a2d-59a8-4687-99ea-c16c061af3ab", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779290, "uuid": "da312c25-6c8f-4c77-8744-77cc770859c6", "value": "98304:MZHwnpRyXg6w2LX/aozUU7j3Rzs3e2z87l4M84wp8lw654xZr8eEcH29:2wnp2zzUU7j3S3ei876Pow6Mp5EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764779290, "uuid": "f48487e3-6ba9-4619-9499-96f0dc3ccf52", "value": 3589097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764779290, "uuid": "7739eda0-f5f2-43d5-bc37-4c636746446f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779290, "uuid": "5216b9ce-9773-4d9c-ac5f-68bff0465e93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4736c0d3-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767359, "uuid": "4e50e110-1944-42fc-9e0f-0cd755be7132", "comment": "Malware payload (Mirai)", "value": "f58388821f78ec51842af56b86917501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767359, "uuid": "7afc2b05-22f7-4db6-bd81-a401a687aea2", "comment": "Malware payload (Mirai)", "value": "01521e8fabd73ef3bed79774842c9447cf410c069e98c4df8fb8f8064802ecfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767359, "uuid": "68f3810a-f664-4415-b2bc-d383d9f183e2", "comment": "Malware payload (Mirai)", "value": "fcfc09b065aa09b5abdf10ec32913ef021357e31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767359, "uuid": "1d59d478-b573-4109-b0e8-4aeb2e11cfdb", "comment": "Malware payload (Mirai)", "value": "c8751ce3d3cc90bf532e64110e9f8b8fefa47b50bca4ee417209c302d783df34f2964c968acc5640f55dc0a89b87ed90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767359, "uuid": "52ee2ff0-3e57-4453-ac69-c136b85bc59b", "value": "T119F2F23616023DA2C3B54C75C39882D1AB62ABB981F5701134D84BF5799C28B947EFAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767359, "uuid": "6e729b2b-680b-4a0e-a675-a4767aee614f", "value": "768:a8kUDTbWxEjsaEh/IhLgF3Kury9bYxis3UozO:a8kUDfIEgb/mE8urC6zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767359, "uuid": "4a7e4ee4-cebb-4f94-8b71-786681e62002", "value": 34692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767359, "uuid": "9e6bd37d-4f48-4f40-a72e-b1f2f6688b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767359, "uuid": "8ffbea41-a31f-42cc-92d6-d7c243f55f73", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447955fa-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767354, "uuid": "73002cca-3ff4-4622-95bc-2ee28972e239", "comment": "Malware payload (Mirai)", "value": "e11a4a07f19b6bef72d2ecb842fc7177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767354, "uuid": "21f3ecf2-c724-455a-ba8f-026ad0cdf498", "comment": "Malware payload (Mirai)", "value": "01f50c11a83949a22d556e08d78523f99589b6554b18752af2283df03f00fbc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767354, "uuid": "bcd9a52b-7e1e-4d91-9aa5-538264c3ddf3", "comment": "Malware payload (Mirai)", "value": "8042cd42c144ba195bc209cdd4b59522ff6cefc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767354, "uuid": "8635972e-d7cc-41f0-9942-cfcf8a0750a5", "comment": "Malware payload (Mirai)", "value": "0256e180ba30ee85975024c7417dc829b5fb571ff0bf1d7cf88a471c7caae596bb772f11d6e4930869b3345afb9a48ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767354, "uuid": "8752398b-ed0b-4960-bdd7-0575962055d9", "value": "T189E2E0A0D2A61DB1FFFA5DB848C4CBE137C45C1B33575AAA24719E10074A8A79605FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767354, "uuid": "768cab8a-0548-4300-8af9-ff7f81e81434", "value": "768:bVU0vqgi/0mba0aZ5lx11rDEhqC3LL/pAeV2L5Ex3yNqTvgwss4uVcqgw09q:b9Dlx5lx11rDKLxBVUM3vX94u+qgw09q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767354, "uuid": "029744b2-8127-4511-a64e-88b23e48d441", "value": 33428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767354, "uuid": "2dcaa4b2-4520-42fa-870d-2f8ef9f4e2c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767354, "uuid": "860ff2af-8099-414f-b212-af024363ec49", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6576bd-d011-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743455, "uuid": "3db2edb6-5b9f-4a5c-acc1-57af97b34034", "comment": "Malware payload (Mirai)", "value": "409d34d38e2621780281a6929919ad54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743455, "uuid": "672775fe-959c-41ef-b005-c5cdbf04f2ea", "comment": "Malware payload (Mirai)", "value": "0244aae45bc1f76c015b343254aaece6915845a8908fbfcc433200162a11c791", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743455, "uuid": "a4aad7a0-d6f1-4cd2-8cf5-49c658f59322", "comment": "Malware payload (Mirai)", "value": "ba87b37103ecdff8d0e446b73a641c379b57b596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743455, "uuid": "489b2e41-8e32-468c-936b-dd0cb914301f", "comment": "Malware payload (Mirai)", "value": "f59a18e3145c1046982442da17179f718bedc3b4acdfaa03ba09810af18a36a48bfd1ae580f7c953f410ed20c9b980ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743455, "uuid": "d52fc834-644c-4a49-9984-e596f0fca141", "value": "T17323F1A4A29450C9E75F94B943C39FC41D5A09794BE7CC40A8882EDEAD878B82DD369C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743455, "uuid": "cb985b0b-f2fc-418b-8dad-e63215dd644d", "value": "768:LXTNifLqyjZL4B0O5/BrCoscKE9vZhJLKVXudDPutqzCSWkhOGlVnegNUkJgGlzy:LDkfLv5ULRBrCoscZjyXud7utmVWkhcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743455, "uuid": "6113e942-ecbf-4fa4-b6d4-94f43c7cf98b", "value": 47880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743455, "uuid": "5b6b5546-bdeb-4b57-8359-86709661344f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743455, "uuid": "47f4c8e9-48be-461a-b3d2-7e34ff6a9ff8", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca38b65-d02c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764754832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754832, "uuid": "674d9a6c-6522-4e2c-85fd-691d113d31a7", "comment": "Malware payload (RemcosRAT)", "value": "bf6e9bfddef227dd69818457b4abc2ea", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754832, "uuid": "6459660a-1b4a-413b-8139-a65013041ffd", "comment": "Malware payload (RemcosRAT)", "value": "0246919f4b9f7e52718b317fa01fc0cdc856e37f3d4770dff90d6febdea842f0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754832, "uuid": "12328468-f809-4755-a050-79fcf359ff10", "comment": "Malware payload (RemcosRAT)", "value": "ef9600942fb6cc57aad22486d30d684f91d6b326", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754832, "uuid": "f9ec6009-1e5c-4667-b352-836962bcd1ac", "comment": "Malware payload (RemcosRAT)", "value": "d0b65de943ef0d5201923eb47821de72ff475cf54d3fa56f5297d1531debf7c0d1d13b8b32f829f02d1abd8b82a1d21a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754832, "uuid": "58868abf-d5e5-4298-b003-3fd8d1b599b4", "value": "T1016423068308CA36D2D5333157C2F42AEE3EDA245796CD205E896B99F88F742E9D7172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754832, "uuid": "3be9634f-9b3a-4c12-aa5a-2f1b2726c05b", "value": "6144:S4lmpinIHDBza6XvgXoNhoJ3G8NJbjEAU3sqFNmpMDnKI4wLHz7:SL+IHDBG6fKOQW6JEAU3JFA27rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764754832, "uuid": "55a8e9c2-c309-4d36-8fa9-e83c8c23d25a", "value": 329481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764754832, "uuid": "41f82b6a-22c8-48da-ab06-2741c4d38faa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754832, "uuid": "7c53d152-4da2-4502-a3d0-2819ad9ebfbe", "value": "scan.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda90964-d042-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764764659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764659, "uuid": "6ff39aee-9086-4de1-a8af-e653a074b856", "comment": "Malware payload (Mirai)", "value": "c68618752af47007f1a0909feac5c755", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764659, "uuid": "1f80899a-8a85-4581-85b5-6b3701e7bf1d", "comment": "Malware payload (Mirai)", "value": "025b91b0113ab068d7465001b42aff05895b521a0f69e4398493be6fc7771cd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764659, "uuid": "c12df728-a4ad-4bdc-b1d6-560db319c79f", "comment": "Malware payload (Mirai)", "value": "ec5776797cd4290a2dfac9d553fa2df132cc07dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764659, "uuid": "85c68318-428b-49dd-a314-ecc245f1b73f", "comment": "Malware payload (Mirai)", "value": "a8e1c4d22b9e0509e41b40edfe804754cfd130621b9e3f4c33b99953be895062f86df17d0e80c0c065cd82773615b7a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764659, "uuid": "d9d26a85-b388-4562-a9aa-c48fdc296f88", "value": "T14123017D82442191EE1594BF23FE0BEC5E235DE5F0828C8759E5EE994AC38706017FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764659, "uuid": "ce89f416-5656-40b6-bb2c-3e673bfcd39f", "value": "768:stUqTPCRNbSyC0EYOjMKL+21ux67UFRN6mw1Dv/liFt8l6zEafk5qESJgGlzDpU2:sZTPINbtYFE21uVFNqD3Et88zEafk5q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764659, "uuid": "cb5a1d24-c7b8-4926-8429-c7fa66f84723", "value": 46180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764659, "uuid": "4a1aabc9-bcc6-4780-8b72-a82cc6eba7bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764659, "uuid": "02478d92-4d73-412a-9ffd-22a64c6983e5", "value": "Yboats.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce86d55-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746860, "uuid": "d46ed885-fa93-45e1-bd48-68750be52724", "comment": "Malware payload (Mirai)", "value": "381227ec14e8c0debebaa8750c24dac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746860, "uuid": "e8d39e82-84a1-4212-af5d-7192c132af28", "comment": "Malware payload (Mirai)", "value": "027eb431f834ad059f81dee94e4c3342580207f528bdd3f3ebbfd4d4ed4fac3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746860, "uuid": "037add1d-2579-417f-816b-23a7458451fe", "comment": "Malware payload (Mirai)", "value": "b53c5281e0506b3577df22f6f19bdc2274227d77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746860, "uuid": "e48092a7-0a50-4ae0-8d2a-2616b7f5552d", "comment": "Malware payload (Mirai)", "value": "80345627c5e544f47b5b20fc8a058568cddb21a35013e808f809b046b885d86f4b2d08c636183666195ba12dde4da213", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746860, "uuid": "15d7a934-7455-4f06-8faf-4191f808f908", "value": "T1DEC35C42B7580A87F9530DB5293F1BD063AEEE8021F0B684798FEA4E5271D772546ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746860, "uuid": "92dd8447-5901-4b1f-a849-ed565c87c91f", "value": "1536:fUK4INXoqjgjiqSdJAQ5cA4kq0tFBt/MzhxwCdkqjTmxfIki+oc0dTJ9v:b2qFdHPVShmCXmxfIP+07v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746860, "uuid": "8900566a-0b2e-49c3-97d7-50bd1c6f52aa", "value": 121584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746860, "uuid": "049e0738-76be-4ed9-b28c-293e202594f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746860, "uuid": "3bc32bfb-46bf-4a4e-b56a-2f2cdfcaea5e", "value": "Yboats.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a79335b-d009-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764739877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739877, "uuid": "d7386b09-5208-4589-a0a1-fe1012845adc", "comment": "Malware payload (AgentTesla)", "value": "83f22d4959a30695ab6831fdec1f80dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739877, "uuid": "aaf6a3ef-2ee7-4f54-8f3e-c7e43277a821", "comment": "Malware payload (AgentTesla)", "value": "0286fb6ee64bc3114fba0197094553083455b843307c874db0a8cf037c8469f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739877, "uuid": "f1145c35-1a8f-46ac-a4c1-3bb11954717f", "comment": "Malware payload (AgentTesla)", "value": "a6d9a2bde390b9c10f5ba64a9b8b44f60b58ea01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739877, "uuid": "e228f9f5-e398-4190-8e26-d632db937f7f", "comment": "Malware payload (AgentTesla)", "value": "0498655e9f18652d915f709afc8570d97f3954b374360029390e5c6e91a79abf527a34dd1e9444c761a7ab03ef1ce49a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739877, "uuid": "de6ee220-cc0e-4cb4-b393-1f9bbd59f8c5", "value": "T13D15F12A6F85A842C670CBB66B9BE37307255DADD5008213BBE0FFAF7473B194845493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739877, "uuid": "750b775b-3126-4bd4-a4a4-fb726b53b294", "value": "12288:7h2as2HLjzEoyLsSxh9BY9xwYbNc7rdirM0JuY9Nko5gOR9KKbmr4N8:l2RuLgsch9BibFrM0NkoGOR9KO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739877, "uuid": "84075297-486f-4427-892f-74b5a89e97e1", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739877, "uuid": "26b6de38-54cb-442d-bb6f-389824e49de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739877, "uuid": "8ca158fb-ac1f-4a89-9891-918d00c70ca0", "value": "z1MAERSK-ShippingDocuments_scr.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75059078-d07e-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764790199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790199, "uuid": "7597724c-da7a-4f47-8562-960c50349e68", "comment": "Malware payload (SnakeKeylogger)", "value": "322fea934264c60a7518380801ce2476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790199, "uuid": "674fc9f9-32ad-4959-9852-b16edc6f0cd1", "comment": "Malware payload (SnakeKeylogger)", "value": "0293ec398b301d984f4e280e528ba7d6c530564edf9fce662dc44e45e8bb5c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790199, "uuid": "47fae6cf-d45b-4741-b743-74b91309adb9", "comment": "Malware payload (SnakeKeylogger)", "value": "bb1aef7bc7e828e5f0adaee282f7f5aede10dbed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790199, "uuid": "3bb6e14b-d1e8-4869-937e-ade027316fb3", "comment": "Malware payload (SnakeKeylogger)", "value": "a0b09b5d8c9d23c886ef67569ad20f6948e479041adfd0f3a11ca0e52b537bca1a3bb448ff864942b1453d39981f7f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790199, "uuid": "af2e8fde-aac6-436c-a6ee-95eb9fda153d", "value": "T1B5E412546694C60BD1A65FB01CB1E8B07738AD9DEC28E60BDFEA3D9FB17AB440805353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790199, "uuid": "605c5c87-2cea-4db7-8726-8836c813819e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790199, "uuid": "5e9cb183-a143-45a2-8b1f-b49fabc617eb", "value": "12288:AdnT5xmV/ITuhgiTDecL+ID6l+fVvYLf3h9TtTXm3IK1lvJ/ndq/74QKPDO:A97mc3iT9RDdWtxB6IoJ/ndqkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790199, "uuid": "99b80988-307a-4b26-9165-153abfe6ea5f", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790199, "uuid": "8a8dcd94-ba5f-4a64-8318-4781f92c4111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790199, "uuid": "0910ed1e-e961-4ce1-a8e1-e23b456722f0", "value": "SCANCOPY hpOE1g6DKS5Up4B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c692895-d01d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764748577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748577, "uuid": "dfa7cd12-47a3-43b7-94ad-af0262f6657b", "comment": "Malware payload (Mirai)", "value": "2c543ae605397fe06a842f3c4e851279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748577, "uuid": "2db76ece-d14c-4f8a-8902-39a67f65d5e2", "comment": "Malware payload (Mirai)", "value": "02b2b2f5427dda8704194a2f7f3c028afcae5aec6dce21d5aa8850375ce7fcf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748577, "uuid": "e428595f-e7e8-4165-b70a-903906201dec", "comment": "Malware payload (Mirai)", "value": "9fc319708539a02717c087ffb2098321e0d25219", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748577, "uuid": "3717d535-a8f8-4e31-8b37-aea15d2f025e", "comment": "Malware payload (Mirai)", "value": "7ffb55556973abea9164da754fc7790cf3267c39fa8bcd52a2325d3d156006621dd0aa5df001ae0e1be10a5186b689f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748577, "uuid": "d6692cab-9d98-4ca3-a7d9-6b316753cbf1", "value": "T194C33946FD818A22D5D712BAF92E118E331217E8E3DE32239D149F2177C662F0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748577, "uuid": "0e540b37-fb67-4048-a5a3-43decfab3ac9", "value": "3072:YL1OEwaES+sdxjgVe/nKOQTxXW7aSVEfjckNb:YLRwxS+sPjg4nKOQTNEab5Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764748577, "uuid": "b80509b3-b942-4765-8d8c-dfe4cab6d130", "value": 128680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764748577, "uuid": "b87af8c5-4274-4401-b0f9-6ef1006c654e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748577, "uuid": "e3d5c9a3-2a73-489d-a73f-dcd8da3d02b9", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66fd15b-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749480, "uuid": "6d156ee9-a670-4d6a-8b66-f6c485ee8389", "comment": "Malware payload", "value": "672ca789d392d63afb6be86bb0427df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749480, "uuid": "30b43f5c-8a5a-454c-97d4-708e3e86d299", "comment": "Malware payload", "value": "034bd140e8b632fce380d3fee560e6e58dd7dc783b4e98aaa01a0e7eabdbec1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749480, "uuid": "857959f7-e525-49df-b00d-3a1a94abe416", "comment": "Malware payload", "value": "abd1ff796a93eac4980fa90bee57ced2389413b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749480, "uuid": "4d7d4056-60f2-41b5-92f7-d4ea275c1610", "comment": "Malware payload", "value": "4caa9d2c2b523c1e01525359f521ad71e3dab6fcbe18b4c1262719174602589cd1a219a94fcbdece3c0c768d78147447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749480, "uuid": "c10cd16e-c5ea-4652-b19b-d13c5e91ba0c", "value": "T1D47623017BF2C0B0E775B1B40496C76B21FA98A587345BC7A7A46F3B2E741D1AF38219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749480, "uuid": "1e0214fc-445f-4775-b1c6-9399a6fb4e40", "value": "4e7ce0c2d4e287e33f0a421844d1f889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749480, "uuid": "f16fad58-e8e0-411f-b1f0-953e7ab1167d", "value": "98304:qvWC15mKLkAXpcdArHjK27dvAk9JLleHVbDc4bi+X+SX8mRwgf900wvkRgjdu:mWC1HzGW7ikjLaVbDji+X+SDVwigU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749480, "uuid": "dbc74508-4c4c-429f-b25d-9add96534461", "value": 7131324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749480, "uuid": "4a78ca6b-a8b7-4a5b-809e-0bdf9ca3b00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749480, "uuid": "77b463b4-4a93-44d0-adb9-1a56461f7b4f", "value": "ManagementCenter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0b9279-d016-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764745728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745728, "uuid": "7c5e76df-e105-490c-9382-28031e14203c", "comment": "Malware payload (RemcosRAT)", "value": "5ccc5f73ae14c68d888e1d9e57a78106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcosf2025-duckdns-org", "colour": "#ADD987", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745728, "uuid": "5fa00269-29b7-46fb-af30-3954274e89ca", "comment": "Malware payload (RemcosRAT)", "value": "03a797a85e78a0c08c78f8ee804d8d2dfff5400adbf65678beb5066761b1d2a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcosf2025-duckdns-org", "colour": "#ADD987", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745728, "uuid": "3dbb0058-dfdd-4afb-a405-b68ce8ac4e85", "comment": "Malware payload (RemcosRAT)", "value": "78afe0fb9ac67e8a9667bd914d2f1d0be08b7d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcosf2025-duckdns-org", "colour": "#ADD987", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745728, "uuid": "d32db666-a413-48f4-9756-2ee912327b13", "comment": "Malware payload (RemcosRAT)", "value": "2303f376db6c94448476a131181ad42bda4534cfcd2f8a7cc265d3ac33690ea8595e8556b6da2bf86b5ec6374c2db03c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcosf2025-duckdns-org", "colour": "#ADD987", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745728, "uuid": "db1bf44e-ccce-4919-be47-1a2aaf02acdb", "value": "T186B4BF01B9E2C172D57654300D2AE776DEBCBD2028358D7BB3D60D57FE30190AA39AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745728, "uuid": "32465161-9163-40e1-af0c-b5a8a319dedf", "value": "41e05d591d7d93bdd5bc6d5da04da74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745728, "uuid": "ee448fc2-f6c8-4aeb-9935-bd4c5b653a30", "value": "6144:KIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZ/FXvXc6YJ:K200OFp+G0imvHn3Cp6qyBP+YdsvZ/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745728, "uuid": "798378da-ff42-40c3-894d-13a7aa692fe1", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745728, "uuid": "73fce3f2-82d3-4fc1-87eb-f598b50d3b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745728, "uuid": "b5072fd3-cf7f-4954-bf55-df676e6096b7", "value": "03a797a85e78a0c08c78f8ee804d8d2dfff5400adbf65678beb5066761b1d2a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290ee0a1-d00a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764740250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740250, "uuid": "1c244d0d-9594-4443-bca2-4ffae943e29f", "comment": "Malware payload (Mirai)", "value": "e300966ab87dc9861679fa85cdc47666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740250, "uuid": "dc5e6c1c-3a22-4937-bd98-28ac85c03491", "comment": "Malware payload (Mirai)", "value": "0410d591519ff2ebba2e7896cbda266fd72c93fed51654b9dd285d8d83422b0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740250, "uuid": "9a63a949-a6d6-4ebc-ab03-47468ed36bb4", "comment": "Malware payload (Mirai)", "value": "4c0756c728117af780930836f1d6d62918d60189", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740250, "uuid": "a7c7697c-8e87-4f8d-a9a2-0032c230e929", "comment": "Malware payload (Mirai)", "value": "6c4c43da7a7a47956db591135affcd8033ff4d90cc36821f35d2387f59fcee66076003940084f078dee839ce0c14f5f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740250, "uuid": "2173f04f-212f-4908-ae04-7a33e8f8af30", "value": "T15A03E15762BBF5FCC46A8AF91C7721D49CB17505516A334B9EC5B47E0A0BF040E05BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740250, "uuid": "a0d2bcdd-922a-478b-b7e5-eafa5862c903", "value": "768:qOFWVRMpzMge4SMQwEx12iQaALtKj56v8e/ml4Olx0KR:SMpzMge6Qw8UiQ5Kbem6uPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764740250, "uuid": "ef0cacc1-ded8-417a-9948-54e1acd8b9e9", "value": 39276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764740250, "uuid": "6149cbf1-0e6e-4775-9f20-37d0a84be542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740250, "uuid": "5e64d48b-d1eb-4856-a051-de02e803d9ce", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7052451c-d012-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743806, "uuid": "6abf9455-11b6-4e5e-bf15-d13567977ded", "comment": "Malware payload (Mirai)", "value": "2f18deb5b8703ac9dc0f86d300b373b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743806, "uuid": "4c8eae35-1fa2-4254-a6a6-475ec8c631de", "comment": "Malware payload (Mirai)", "value": "042e797237f2824aed82d43842a8d61c2015a482d68223dbdec56a133e7addb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743806, "uuid": "880010b0-3322-4359-8377-0c66887fad2e", "comment": "Malware payload (Mirai)", "value": "a0f4b44b43dafd02d33987fcc43453202effd008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743806, "uuid": "b0045ccd-8274-4222-a61b-5a21ef2758d8", "comment": "Malware payload (Mirai)", "value": "2f4c6c571c48d651109cea8edc9def8cd263fe62cd1ce94a6dea445faf67f33b898eeea46c8f5090b5bd6aed2c997c8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743806, "uuid": "a6de5440-a92b-48d2-88aa-c719e18ca0e8", "value": "T1E923F24DF41C36CACD59C475EA6CC36FA540C1E0A06E8F1C9FE68C409585D1AFC8E4B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743806, "uuid": "30956134-6a19-4fb0-a963-0c843841e7ff", "value": "768:i48022xcwQ4ML28OLGDwetnXmAaj7lFkqor3eQpuc9wpvEPAWw:X226/LJGOXm9RF5eAkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743806, "uuid": "539fe52f-a943-4346-9ee3-f0e671bdff3a", "value": 49808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743806, "uuid": "b9d2172a-6936-479e-a317-2323370a60a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743806, "uuid": "a793cc0d-3b40-4463-82c1-112e3f16cd5e", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd49a766-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793783, "uuid": "d679f17f-7f38-4277-92b3-48b4d4164fbc", "comment": "Malware payload (Mirai)", "value": "5fa027a5acbea1cae088d498e8ae154c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793783, "uuid": "3e0bdadf-48d4-4fac-ae84-d690cf774359", "comment": "Malware payload (Mirai)", "value": "045a1e42cb64e4aa91601f65a80ec5bd040ea4024c6d3b051cb1a6aa15d03b57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793783, "uuid": "b3241fe6-6dd7-4503-bb3d-a289e7102525", "comment": "Malware payload (Mirai)", "value": "c98c242ddd94fec0b73ef6ae444b70a738e77bce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793783, "uuid": "ad847012-3923-42fd-bfa1-ac57a1853212", "comment": "Malware payload (Mirai)", "value": "e85aeaff637a6a1e194502ee998fbe7cda9d73a84d8a0cc52f607dfc5f6eb3f306534f8629fdb53d6abcecdf04d0b474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793783, "uuid": "ac6e7a3b-db92-45a5-8bb3-4ba883594b20", "value": "T1C823012FB6539EC1CCD4653446E98986EE4957FAC2CFA5B12A380718ADC3DA31C7601F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793783, "uuid": "e505379c-8363-428a-8f62-7681c379631f", "value": "768:WHaci/tqm2ytTB9QGPO7BTOSE7qPi3PNwYJQvQEDKTkPClB9q3UELYX:VcilHztTdPO4SKN3aYJQ4EDKXl0Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793783, "uuid": "657c6860-63fb-4046-b89a-d5f8dcb64f9a", "value": 46204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793783, "uuid": "65169c49-9c09-4cd4-b0f0-6322fc22ea89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793783, "uuid": "741e1c02-c6f2-4694-afc0-31f87bfe3791", "value": "zerobotv9.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfb7ddc-d004-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737733, "uuid": "10bc3d42-8cb6-4f4b-82bf-4b8e1ce6ca9a", "comment": "Malware payload (Mirai)", "value": "7ba1dfa806d6ab2252cce2679cb2e150", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737733, "uuid": "f08b6b3a-0949-4d5b-9808-092f41ebf0ce", "comment": "Malware payload (Mirai)", "value": "04a55ae2141ef1c9f2f27af4fc77f1ded99c72909b3dd73fd4923ea187e7b235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737733, "uuid": "5a09ab6a-14ed-4342-880a-053ddefc2756", "comment": "Malware payload (Mirai)", "value": "0a0c301122ac073acd4a53c5ac7493f9cc29da02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737733, "uuid": "8ccdfa71-2aac-4a1d-baf9-c23697c2e422", "comment": "Malware payload (Mirai)", "value": "51b6dba43301d031ef506b6b1512f6c939f2e7659cdaa7c343c9b3a59d3ff7e9f10851a542b770d411ff85431c3bbcdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737733, "uuid": "b9b2e9d0-0705-4064-96d7-89ee2a238c90", "value": "T18F547D88BB4DEF03C19483B6E96B0623A33934517B4BD7637825612EEDD37D85C5328A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737733, "uuid": "ab38b8c2-4d44-4f8b-87c8-6059f9b09f3a", "value": "6144:sCklHVubHrIs1AmhkK+Gs9QWOgLohjE0L4rlTd:5kqHE0wtQWOQohGrhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737733, "uuid": "4a3c9a51-257f-44c8-8e76-1680c9f9ef68", "value": 297096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737733, "uuid": "c46ceb37-a7e3-4675-bd3c-e932874abadb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737733, "uuid": "35aec978-128d-47dd-9a20-76c247d3b8bc", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c45c0a-d017-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764745846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745846, "uuid": "9a68d329-f1f8-4730-8cea-3b9110eed949", "comment": "Malware payload (AsyncRAT)", "value": "f047b8ee1da1ac0b477b0d71629c0b53", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745846, "uuid": "2941bc79-c7ff-481f-bea1-5d99a04a53f3", "comment": "Malware payload (AsyncRAT)", "value": "053649d688cc2396bbd1d262042ab986a510f9aa9a11bc3ff869a277553f0443", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745846, "uuid": "7a4446c7-3a7a-4540-9e5e-a03ab2bac61a", "comment": "Malware payload (AsyncRAT)", "value": "0c75e4379cfb0d679d04e0bea4d020cc93d525cf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745846, "uuid": "8e90bc08-1bdc-4497-b8ff-03925e43713f", "comment": "Malware payload (AsyncRAT)", "value": "7b9c898762554acfcde9f61ccde951eb9a34d79042e3ace2274ea6e4871bf7d41316282d6b02bf5c0d4b27be2e7cbed0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745846, "uuid": "76595fc3-67e3-4408-a8f6-039a5bb832dd", "value": "T1D0E23C4877E44312D5FEAFF02DF3B10A1275E11B9913EF5E0CD48A962B639C146907EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745846, "uuid": "47eac228-ab11-4324-8799-fe4d69a852bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745846, "uuid": "676d4e47-3863-49e3-8b56-66b36d679e66", "value": "384:rYaJWq4Ava7Rm32oDuuw3+q5XwYeLBEBvh0FbOKTCOQiFR6pkFTBLTAOZwpGd2ve:VxC3fOJ5yBvGFbO75iFDFo9jtOjhEb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745846, "uuid": "42f2bbd0-0eb3-44b2-b4a3-11b472b8fa35", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745846, "uuid": "dd6b95c1-3e9c-4094-9266-9bf1fdf4602a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745846, "uuid": "65984d6e-083a-40cd-9f05-72b816db1426", "value": "053649d688cc2396bbd1d262042ab986a510f9aa9a11bc3ff869a277553f0443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a7d26e-d071-11f0-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1764784647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784647, "uuid": "e6f48c52-942c-4fcf-a931-c0b8eda6af46", "comment": "Malware payload (XoriumStealer)", "value": "c59deae4284eadcd9edc67b0db96abc4", "object_relation": "md5", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784647, "uuid": "fa2ce1ff-45ee-4d7a-be03-b7896faf9599", "comment": "Malware payload (XoriumStealer)", "value": "05f68525352971f08ec5b69ce138b63f0bbba0ea72e35cd34d8437e9d1669af6", "object_relation": "sha256", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784647, "uuid": "4709ece8-7e25-4819-89e4-55ff7a64b021", "comment": "Malware payload (XoriumStealer)", "value": "738b36445cbf0960bc7a3b0b32e1b6e5233f7400", "object_relation": "sha1", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784647, "uuid": "e0ec3db8-f494-4b3f-97c8-50fcbb14345f", "comment": "Malware payload (XoriumStealer)", "value": "3cd2f1eeb31a942bc3417ebdb0eea51d5371bd14e7249dd57a3ce308485f4cb1e85c1cab81c0aaf3c4973a456020a3f8", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784647, "uuid": "ee66eea0-7f0a-44b2-87f3-e73e0b7be31e", "value": "T180965BE726C1B59DC15AC7BA8322FC3F8F4FB8794A16E5EB50347255A927C00B214F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784647, "uuid": "9ac80fe8-87c2-4f55-a546-09a36edf2455", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784647, "uuid": "a30dab7e-564a-4423-8a71-363d2942ac03", "value": "98304:pMcSUsKZFxOC5LRsM9wl/WmKw704oLGq0MhN+VPG3UkJ/JMLyu5xueOn:71sKROCRxilWmvyGiY/kCyixQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784647, "uuid": "68ec3b21-b2fa-4ca3-9895-bc881aacbbfe", "value": 8821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784647, "uuid": "cd671a10-655e-490a-9a01-3b063d850ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784647, "uuid": "bfd1e421-47c6-4c40-98d9-1a62506a95c8", "value": "05f68525352971f08ec5b69ce138b63f0bbba0ea72e35cd34d8437e9d1669af6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c7900a-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806337, "uuid": "d6be0fd6-f800-4e52-a642-743bdd624eb0", "comment": "Malware payload (Mirai)", "value": "a28059de93f6cfbfbb0eacef66b23676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806337, "uuid": "72c61f0d-a85c-46f3-9a63-e402faaa1204", "comment": "Malware payload (Mirai)", "value": "0629f0cba0b6bcd18b4d5a11316f804d8abe8c74820cc7f387a6b6017d4fa84f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806337, "uuid": "f4e447d1-07d6-4343-8825-15ef195eeb96", "comment": "Malware payload (Mirai)", "value": "6d845ee1e48949b52333eb522555d31e37c5a2a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806337, "uuid": "ecaa06bd-81aa-4d38-8b95-fcfa001e26fc", "comment": "Malware payload (Mirai)", "value": "89504229cbb8322c5b98a4ce833909e7a5a43c34e5ee63f900bcad7a11f5ca70ab248f0fce4d15cd4eb4eb0d65228637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806337, "uuid": "d9f30800-ada1-4187-be97-c6963a79ab76", "value": "T12E230285B126DE11CF20723B98E34429BBE63AFEF160F0241984AD6D37E499978F445F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806337, "uuid": "2f96b10f-e544-417c-a2d3-62e016f448cc", "value": "768:bBUEqwVkNpLviNmQDeRdJmLN9YZ+GRvMpHcpxZdpZgPdL+1ppIOnE/wt9q3UELUF:TVk2EQwrBCpHc7ZdcI1vfnGwALS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806337, "uuid": "db856123-918a-4a9d-a5bb-297fcefddfd1", "value": 49176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806337, "uuid": "46e50c8d-5586-452d-bac7-a5c1dcf3e06a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806337, "uuid": "002029e0-f5d3-4175-be07-14fd9bf7072c", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb60a75-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764769999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769999, "uuid": "f86fb62a-9b57-404d-832a-41be0c3d6705", "comment": "Malware payload (SalatStealer)", "value": "59155db478d8f41767563d5bf073df7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769999, "uuid": "8b4e861c-c64c-46b7-86e8-3d05c3c8c474", "comment": "Malware payload (SalatStealer)", "value": "065fafc5e3a52b618e7763df8a9269cc8e7ac397fe220a13dbe93ba0c18805a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769999, "uuid": "3865515e-854e-4818-b371-d80ff34b79e6", "comment": "Malware payload (SalatStealer)", "value": "c60274df1b360a18204b3d7192d6a3c7429bae68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769999, "uuid": "3262abeb-9f04-4971-ac77-b5aaa62523d3", "comment": "Malware payload (SalatStealer)", "value": "dcb50a497e40cc7d63196a8d3c8449248425c0047f288a2c6f1a93dba5fc69b4edf4b4590e1f11848d1577c26b6174fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769999, "uuid": "9e382812-81ad-4061-8cfd-7677118381f5", "value": "T10FC633A1607727A6C75BC7B2A0C3203AFCAF0A64E5B854CB7F231A776C568FDC214546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769999, "uuid": "5338b02b-9735-40f7-90b3-0cbd4f1ad990", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769999, "uuid": "4b3bd0cb-e24c-4366-97e6-248e516f2f1a", "value": "98304:7+I/7x2EZjfcH8VHT4qUahzL6peNVWkRtaYH:7+02EZjfcH8Vz4Lm6wNAkjaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769999, "uuid": "b2728359-d1a6-4970-8de1-67e5f2e5cef4", "value": 12107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769999, "uuid": "1a0efbc1-cbb3-49b2-bc77-85b795e86079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769999, "uuid": "45a46240-148e-4358-a4d7-be8c305e03af", "value": "59155db478d8f41767563d5bf073df7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d5eef5-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793850, "uuid": "fbe953e9-1ddb-4b2c-a821-d88eb26e9565", "comment": "Malware payload (Mirai)", "value": "7d3d73ea490a3f29e28aaeab845a958e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793850, "uuid": "50762f0a-ff79-4633-9418-777cc3d3ccf4", "comment": "Malware payload (Mirai)", "value": "0676dde57be059821c91b9774251fa6ac5952b0655d127118007e73597ec96aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793850, "uuid": "bfcb5325-d193-47d9-b646-5650cf7c3806", "comment": "Malware payload (Mirai)", "value": "e6ac248b8e99635b0ca6d12fa33b4b238084f559", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793850, "uuid": "25f9b225-7b4c-4626-b03d-d53b5a8743c2", "comment": "Malware payload (Mirai)", "value": "aa1765413ef25683ab207e8c58791d4b5bf2bff0bbb04a3c5bd43128c2f38f0e011743fdb8f045ea6ff84f016f71d95e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793850, "uuid": "c05985d6-f633-44e8-9e7d-4efdfd1bfba5", "value": "T10B935C0273080E47D1A65EF4263F37E5C3EFD59121F4BA89660E9B4681B5EB3244AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793850, "uuid": "c2a9cd9d-7438-482f-9054-dfe039ce0ec2", "value": "1536:VTcEZqV107WerJN/xchCIFe+8mvngkvWqgQF:VTbqVaTbmFImp4QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793850, "uuid": "8011e64d-00cb-4499-b2eb-f3d6f40be83f", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793850, "uuid": "592e0318-937b-491c-be4c-d693bcb4f18e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793850, "uuid": "f0e398ed-7a38-4def-93da-1ac8ca9d7ee5", "value": "zerobotv9.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b81163-d008-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739390, "uuid": "484a07af-de3d-47c0-9cfb-0b286bb7f62b", "comment": "Malware payload (Mirai)", "value": "6cc099339b1661b12687c4c1eba223e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739390, "uuid": "e96ae95c-81e8-47c0-b37f-b818eaf8ee33", "comment": "Malware payload (Mirai)", "value": "06c29d034f81cb47812d0777a90a679538b9418516125a1f0ae107e3d413e03c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739390, "uuid": "d058c932-b6ff-4035-9608-4ec882453db8", "comment": "Malware payload (Mirai)", "value": "599a074fb1d940e54680514a9aaf8193e60ab16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739390, "uuid": "73e3d797-ea73-4af7-8929-f0f9f791ef28", "comment": "Malware payload (Mirai)", "value": "0a92da08f06b38eda3a2b489fd38e3a09894c07a1aa689615dbea1c4fc19cfdc4c3d5b59cb0a03bf24b8fa45aa538938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739390, "uuid": "f0ccb29b-5a12-46a4-9838-d366a428d10c", "value": "T1159301967DCD5094E5E9A33328CFC2B91E369D4D91B7B01EDEC6078425EA0AD239CF12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739390, "uuid": "3aeab4a7-4fe9-4176-ad85-484fa55255e0", "value": "1536:bKg390A9biXsW0qhfQds3r3gG47zSVH5fold+UteuEgOm2v71G5wCyf:bKg3RbiXsoQs3r3gpzC5folPJEgY7Q5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739390, "uuid": "1762b402-532e-485f-b47c-873dc8f38f16", "value": 91832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739390, "uuid": "b36b0124-d52d-4d38-b24d-5cc22b54b910", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739390, "uuid": "94477cb6-4254-4782-919a-0bb072362c78", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a879e47f-d019-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764746906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746906, "uuid": "f90ea4ee-3c70-4a03-a8e9-af9f1fb7f421", "comment": "Malware payload", "value": "bdc5e518856adccae98d711680412578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746906, "uuid": "d77edbb2-1642-4875-9446-b5408bb0e2ba", "comment": "Malware payload", "value": "072333ce09b199d45b08e799eb28d8b1a2940f4afd97083ca12d4b2573a6922c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746906, "uuid": "e67cfea0-b39d-4c6d-8d64-4215e7084980", "comment": "Malware payload", "value": "a09a42c14086213e26f915ac4f1dd435fb80ac9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746906, "uuid": "12eaffb5-6f8a-4372-9209-7b6235469623", "comment": "Malware payload", "value": "b9b1159670bc5ecfba8f748cab048e2801a708e4423d3344a7f6073ac7918c0c6fe72aad8585afb54b1508800099b5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746906, "uuid": "f73592ed-f5be-4d2e-8c11-1aa2ac171a2f", "value": "T15F1633AA44912519B6113D31E36EFAD06A2634336BD270B48C0BC9E58377DE3C6E7B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746906, "uuid": "1d320d25-0d88-4d99-aa07-4462b8d847d1", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746906, "uuid": "d0e04d76-dd5f-4ae4-a860-10987f036f4c", "value": "98304:Ipyd3KuO+HhttcPHWasq9EBrdydAqDJu6iqtQ1N8U6q2+Q92sQQ159kCCUdJRTIV:Ipq3j33QWyEBQdAUJuOa1yUV2F92sv1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746906, "uuid": "672aac26-f690-4564-8418-4d879ac47527", "value": 4134912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746906, "uuid": "843ba3dc-ccba-4d51-a6a6-a0391ef64520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746906, "uuid": "b9cd0355-db37-462e-9dd7-c4a868ec28cb", "value": "SecuriteInfo.com.Win64.Evo-gen.49255384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb1779a-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767883, "uuid": "72e1ac3b-1a4f-4d35-b6c7-3fc9e10d2fd5", "comment": "Malware payload (Mirai)", "value": "432b5eb11c8b2b12237b1ac931caaeba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767883, "uuid": "78f3446a-547d-455b-95a4-cadecd400a5d", "comment": "Malware payload (Mirai)", "value": "0736885e677bd68b361aea496c36c7035f04a1ba48520f6e11bdf791906dca2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767883, "uuid": "b6d9d5d4-5d98-4c8b-9993-29e184a06134", "comment": "Malware payload (Mirai)", "value": "f4f3180fcc6add47ec0845b0f0d5ec11a1106ec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767883, "uuid": "9d921705-124b-4302-8aff-299f2fdc52f9", "comment": "Malware payload (Mirai)", "value": "e463005a87efc47a6ef41ffea2136da9c6f7e83a6cbec08aba7f0e27c3f6e0adbb386bc2009f8915e3ed9bd76d0355ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767883, "uuid": "8c577c73-6450-4ad6-94c8-f19959616f32", "value": "T1ED23F18E60467FDAEB8C6C3DD6A3031258DDB0843535575E6390CEACFA6E147928F4D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767883, "uuid": "fec3797c-e0d1-4887-a770-f7de96b4cb88", "value": "768:UlUjvbLuVh4Mmzf5xxdmBw/lAjGJV+GAH0ICqUJt2RFT6zNhvrRSPSde4e1kWMr:qUiVhQ34s+jG2GAH/snvrRESdpe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767883, "uuid": "e986beff-5fa1-46ec-a111-02044dc04623", "value": 47424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767883, "uuid": "504eb3ea-33d7-4a4f-a923-41def0331325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767883, "uuid": "c53f7aa1-03d0-4759-b358-e274367096d2", "value": "SecuriteInfo.com.Linux.Siggen.9999.142.20025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb6e4c6-d07c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764789460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789460, "uuid": "d712a2ee-334c-44da-835a-25b0288cfb76", "comment": "Malware payload (RemcosRAT)", "value": "d9efb81cbfa6e583e88f9f8a31056e91", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789460, "uuid": "6dcc9159-5617-4321-8303-76dd31399803", "comment": "Malware payload (RemcosRAT)", "value": "07e680a03d81fb8593ce22dc0de55543b2cd714ae0136ac201f4f88b07f3b290", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789460, "uuid": "e534fb3d-7136-4b12-b80d-705ea70df586", "comment": "Malware payload (RemcosRAT)", "value": "c30db8da1ae859dcb7dd631a64449195abf081d8", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789460, "uuid": "cca99010-0d31-4424-a955-1a1174387268", "comment": "Malware payload (RemcosRAT)", "value": "629e817359572db5576a6fc09f3be766fd6cd77aca02c581ef7f92804861f14b6420bc8fdce1c53598c7180d8058d84c", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789460, "uuid": "adf6a4d7-2149-4a33-b9d5-bfea2f83aaf0", "value": "T19FB2621998A99068182348F7782C4E7EDB0C92E740623A2E7DCDF8B95D957CC3C8DD93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789460, "uuid": "99b64fd1-631a-4097-8611-3fa099cfa365", "value": "384:QPLI3+XdW5VBR1EvY07Zas3SvAL002AOobC08ma:QPLI3+Xd4ovYNsCvALNOk8ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789460, "uuid": "404a688f-f600-4164-8be6-92d42a35fb12", "value": 24884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789460, "uuid": "d6d0acce-e17f-4dbf-a2ca-122eccf9157d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789460, "uuid": "9d4f9c11-b87e-4b69-9807-c77edc22d068", "value": "transferencia.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbec51cd-d042-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764764548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764548, "uuid": "a0a61875-54c7-4d19-86d8-b6a23fe2bf5d", "comment": "Malware payload (Vidar)", "value": "e1e9a40064344033f52aa1c8ea03e1f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764548, "uuid": "ae3e9578-eb5c-4655-aea7-934bd0690e19", "comment": "Malware payload (Vidar)", "value": "082e20ebd9a478f3e72f51f3bd51b88a7aa5146c5fec30bed5f3702c31e1c730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764548, "uuid": "678c8c94-b6bf-4f95-a3f0-e5d4f6635708", "comment": "Malware payload (Vidar)", "value": "31868c50c8504c04bf3793739e6f8195a9d300e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764548, "uuid": "8c8163a7-f316-48f8-a5a2-722502a7b1aa", "comment": "Malware payload (Vidar)", "value": "4492099e88ef1378ca018e3340a2267562458eb4c488e28baffdcf4647f31e10aa07025c058e5d0ed9dd39e226825450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764548, "uuid": "d66de2ab-e005-4e9d-b788-52294be94a93", "value": "T1B086C586A982847AC359E1349D70A2607F757C1943332BF3DAE79A660CFDFC01A39B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764548, "uuid": "1e8f245d-92a0-439f-bb1c-c4266ff75035", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764548, "uuid": "b3623498-4b66-46d7-a3c3-e381a93ba0c7", "value": "98304:W+3iDrNUAhE1LkbvwGml07gM2VtG7XotH:W20Nnsgwl07gpny4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764548, "uuid": "6eba00ec-2ce1-4f9d-988e-c035fa1fb1aa", "value": 8166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764548, "uuid": "96dd0ca1-b927-4411-8c51-f9dff6979b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764548, "uuid": "b5c3edf7-53d9-497d-b93f-b29348fc7942", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d6e5fb-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746855, "uuid": "8ff5ae9c-7927-417a-b653-a996e0f21bf4", "comment": "Malware payload (Mirai)", "value": "414fbe955f316870d190e5ba9377d229", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746855, "uuid": "ef4bcd71-4941-4148-b252-58fd0d13bc69", "comment": "Malware payload (Mirai)", "value": "096112b1ab053667b2b8ca8cdb6a2fe3c0c47f5236a8142056da9473d27c70d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746855, "uuid": "ace47dbd-6f7e-4b73-8395-2731d7be82b6", "comment": "Malware payload (Mirai)", "value": "651641c2f61d4451ab76521eb80ffc914b7e97f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746855, "uuid": "163bb5fa-66eb-4475-bbcc-4fab9622eb10", "comment": "Malware payload (Mirai)", "value": "fc20e2bf48017a4e3115f1f810c4a8ac8440c6fbbddd2d40bb8fb3ada82dd3b6e77579b8974db18104345c8dc0e06ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746855, "uuid": "658ec3aa-46f4-4900-970a-f0f1d32d53b0", "value": "T1C4246D46AA808F13C5D2277AB69F414933329764D3EBB3068D286FB43B8765E4E37605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746855, "uuid": "7dbf5fdc-85d6-4f70-aa01-7363487f7db2", "value": "6144:v09OpWqcBX+en9IaRs4eXnEc1SETc9M/9df8F/:vUOpJcMk9IaRs4eXnE7ZK/Da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746855, "uuid": "1dbe1b74-ed91-44ed-83a1-7b2c7f7e45a3", "value": 214629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746855, "uuid": "6818eace-d7ff-42ef-9353-27127b6b7576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746855, "uuid": "b279bae3-0aa2-4b9a-bdb4-633c48577ad9", "value": "Yboats.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d0f84a-d0a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764804770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804770, "uuid": "668e31f4-e25f-4ece-abe9-e43dbedff5ea", "comment": "Malware payload (Mirai)", "value": "7b15d86021e689e66c06ce294d5876ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804770, "uuid": "9517f4a6-6cb5-41dc-98a1-0659d5b3febe", "comment": "Malware payload (Mirai)", "value": "0ab953623d6be078873bf1b8fdc0a80bf6b78042bbc3a3f813168ebb5a1a1f7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804770, "uuid": "ac36424b-1e8e-48f4-b6b7-4f04eac9a353", "comment": "Malware payload (Mirai)", "value": "5117295db4e59ef045213217e61e35a56a8cedf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804770, "uuid": "4e5c8c83-b4dd-4ec3-aab6-b4a36aa052ca", "comment": "Malware payload (Mirai)", "value": "c2b9a02aef46967de96cced904146ebebe69de002c71efea138676fcff7f8b25416c30962276a801c790c53a40f067d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804770, "uuid": "775fbfdb-52fe-4768-bbbe-cb8913bf1cee", "value": "T1CBB39D32C4156CA4D5954034B9E5DF392B23E1C093631EF71AE5CAA798A3ED4B809FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804770, "uuid": "dc3c320b-60c2-47fd-804b-5aa9e1608740", "value": "1536:m/QJyd3WjIYFYQLlUH4UVC7WevChTRZKyMVpLLq5CK+3j:moJbjqQLGcWqSTRgywLq5Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764804770, "uuid": "dced72a6-63c0-4751-bcc9-1990709154f9", "value": 108256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764804770, "uuid": "e6678fd5-f316-4f8b-9759-75abae863a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804770, "uuid": "15c6a121-5c2e-46d4-b65e-9fb4ae04315d", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d2a999-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746867, "uuid": "d1e6c39c-406f-4b56-954f-fad2630bb173", "comment": "Malware payload (Mirai)", "value": "75b5f0eecf1dfc847c53290cb9161a06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746867, "uuid": "e91c877c-6d65-42f9-b58e-5db1d95bdb03", "comment": "Malware payload (Mirai)", "value": "0b1c4e7b9e3b42ef4f12caecb2d831e652bddc082b174b3cbc7a83e511fa234f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746867, "uuid": "17fdb9fe-f601-4ec4-bd21-7738621ef936", "comment": "Malware payload (Mirai)", "value": "f75bc5e3cb39159cb2a9cd791e505162d6d24baf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746867, "uuid": "971ab9d0-8681-41ea-afdd-97d624a001c4", "comment": "Malware payload (Mirai)", "value": "f916b35d2bf48d24e9cc1b20f6518ca5ee88410c6da8294a1e77a4225a38f759c7da3ee4f495fd940fbfe6ff93b4e4ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746867, "uuid": "45ecdbc5-ce13-4c6e-8495-a0cf9a8f684a", "value": "T1A2A32B46BCD1DA6AC6D023BBBB2E229C332153E8D2DF7117DC24176826CA55E1F37A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746867, "uuid": "64029076-6138-455c-a310-a86453cc1375", "value": "1536:bsMBnmDEZZ50XY/1MRra+UtQj5EWDA79OhGhyf8TZX56V825YAbI3zP5cJWwHa4y:JdZmXq2jiVwJjI6sYtppu4vT3S6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746867, "uuid": "3247434d-f5ff-4338-8911-75148d84a5e1", "value": 100188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746867, "uuid": "a08bdb64-885a-4dfe-851b-a590f2cb87be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746867, "uuid": "60a9a91c-0499-4426-a3e3-36ff3682680b", "value": "Yboats.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63a3940-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764768028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768028, "uuid": "49fdd207-7623-492d-93ed-7315652d2dd2", "comment": "Malware payload (ConnectWise)", "value": "254cff27a04f47cfa730c0ff5f8f4594", "object_relation": "md5", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768028, "uuid": "b3124b19-3e6c-4131-b7b9-6aeeb2745976", "comment": "Malware payload (ConnectWise)", "value": "0bf813a35b9343fa17cce21cf8a7ef723779769c253146ae504791cf6b980c23", "object_relation": "sha256", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768028, "uuid": "adffe709-baf2-4e04-a5d3-083a9e91bfa7", "comment": "Malware payload (ConnectWise)", "value": "2e962c0a92ab98b24a11b02476126edafbb0dfe8", "object_relation": "sha1", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768028, "uuid": "e8481e2f-f214-4475-ae17-6199be0917fe", "comment": "Malware payload (ConnectWise)", "value": "0ff075d4b83da79ac49bc39e34d6cf09bec88e3747e16e914ee77626a1236ddb13fbb4bf253b4182ef36bb60f14daaf6", "object_relation": "sha3-384", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768028, "uuid": "08a8c888-c3de-4fcc-8158-8c635d52ec76", "value": "T15D75E03132A4C039E2B61A39E93A85F16979BD24DA63C15F53747E1E3970E8096B3373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768028, "uuid": "d7db6c03-56d8-4ec8-ba2b-783c46c257bb", "value": "49152:+eccp6EsToWTn1Yt+fLtXGundZRT4T1g:JAEsToWT18+hGWkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764768028, "uuid": "a00051af-9e09-4df8-99dc-e5542c739870", "value": 1597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764768028, "uuid": "5265e683-2ac1-46c7-af30-6ca3552d01b1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768028, "uuid": "86522ee9-8df5-499a-8163-2d8cc070dde4", "value": "0bf813a35b9343fa17cce21cf8a7ef723779769c253146ae504791cf6b980c23.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a094109d-d09c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764803157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764803157, "uuid": "e032cbd6-8ccf-4d4c-9aa2-98a4d6d7e8da", "comment": "Malware payload (Mirai)", "value": "6ba6c5a02cc9aad7f3be023392252855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764803157, "uuid": "c1047e16-3db0-4235-8fc6-0cb77476de08", "comment": "Malware payload (Mirai)", "value": "0c3176fd18a0edd85766a7201f2a4f327bc2542082e3791198e0b48cfbc6b25c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764803157, "uuid": "a5a2fdd2-0ea5-4e7d-a8f2-52148dc8c00e", "comment": "Malware payload (Mirai)", "value": "156fdf25f22ad112280fb164c32ab1c47fd2b056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764803157, "uuid": "40d2e774-b707-4383-82bb-186e41e79334", "comment": "Malware payload (Mirai)", "value": "f7f6b05aaa157e2348981586d3aa95e852e3da6429d7efd1240f7ecbdfd04e8b5c16c572a936fa44f26556d6163dacb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764803157, "uuid": "d2138f50-fa46-47e6-a5af-eb1ae97d0ebc", "value": "T1A7040A41F8144B57C6C22BBBBB9F439D37335B1897DB3301AA24AEB42F8679C1E29511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764803157, "uuid": "54b8b9e0-746e-445e-a88c-799dbfba0f1c", "value": "3072:TDfwbxgOGFc4wKdEJER2CRtRlHSFXBnOOvzBGwoUZaErar/nHUXD:yxgfFc4wKiJopR1HSmOvzBGwoUZaEraK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764803157, "uuid": "46cb70c7-0257-465a-8d6f-510b4bd6db12", "value": 184928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764803157, "uuid": "1990c966-1bfd-4ba9-84db-a2e9f9dc906a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764803157, "uuid": "c0bdf466-e0ac-4330-b9a8-a4baf978cea5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfe487a-d03f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763045, "uuid": "b3db197e-fd0a-47c5-91b6-98672f240feb", "comment": "Malware payload (Mirai)", "value": "c98a76df70c3d83b2402b90e44ba2554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763045, "uuid": "6d350eb9-8bc7-408a-ae95-f8eed9d6efa9", "comment": "Malware payload (Mirai)", "value": "0ccd08509b65addd3809771a329c9157e2a06ca92a096275be9af3270ae44b26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763045, "uuid": "557bb817-9d2d-4fa7-849d-19191dbb63b3", "comment": "Malware payload (Mirai)", "value": "13e6edda6bf6e7b6728c633655c8339b97df59f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763045, "uuid": "a8d18517-0b11-4236-85ef-4967676a508c", "comment": "Malware payload (Mirai)", "value": "b8c4e8e27c5d81cce28fe26dec738f74afec5213c1db7f03d538e1ef514f01987edaf43d3b4566ed3e76bf99f4a92a6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763045, "uuid": "de3265ff-bfe5-4e5f-a3bf-c2e00a3d74da", "value": "T10FE3B60E7E319F7DF7AD863507B78E246358339622E1D184E16CE9111EA038E642FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763045, "uuid": "93047a80-e9d0-4b12-90aa-8abb8156aa85", "value": "3072:PVVIXBxIVjPEtKT8Tx8HN84O6UnGyzYfxlfcv9hilv3AvYTro:PMBxIVrmyt8vnGyzY8vfipNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763045, "uuid": "22bbb1d6-0264-462a-84b4-d91bc0a96626", "value": 156560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763045, "uuid": "d5daadbb-c438-4d7b-8555-874a2f6038d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763045, "uuid": "78eaa5ed-47f1-471f-9bca-5d754c8df156", "value": "SecuriteInfo.com.Linux.Siggen.9999.22757.26882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cdcbd7-d054-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1764772078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772078, "uuid": "89e5bd0e-6468-43ec-b639-9a63508c4fc3", "comment": "Malware payload (VIPKeylogger)", "value": "bfdfa68016b705afd4c4f60301f5f559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772078, "uuid": "dc4ce508-2c1f-42ba-af97-4e4100c5a1c3", "comment": "Malware payload (VIPKeylogger)", "value": "0d38177cbe3469d1e658d8b8bdf7785c2ef0c0021c7e08aa5ebbe1904d34d1c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772078, "uuid": "e7d29b35-4eb6-4f1b-8c63-1900609f1662", "comment": "Malware payload (VIPKeylogger)", "value": "9f01618c6805c3e3e92c82120ae6dd904bf7aafa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772078, "uuid": "da90d2ab-61c1-4821-81e5-678abf317845", "comment": "Malware payload (VIPKeylogger)", "value": "2903a583f95ed3302dce63c2149a5d32f14d2bf0329c2f529300f1815ddabc22c43f04959fc0153aff46aaa6e0c78cbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772078, "uuid": "03ba7831-115f-4aae-a54a-fdce7e671810", "value": "T11CD402D1B201E9A5F3CB04B1D2779CFAC669AEE9E98707076755BF7D3A331A10018607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772078, "uuid": "0a85a9c2-4976-4fe5-b724-03a489aff3c8", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772078, "uuid": "3986b9c9-4a22-499d-97b8-e233503d5abc", "value": "12288:ykTBokmIo57hCpjBmuNxSOUe9c+mCJD9EHezRH++Sq9B:VtNmIojCpHF9c+rJREHep7Sq9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772078, "uuid": "8b90fc7d-e039-4492-8160-3797f7e89327", "value": 646040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772078, "uuid": "dda28edf-7c27-4467-adae-ddbcf8c37849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772078, "uuid": "3908e6b2-f9eb-4218-8902-f8b512c4c2eb", "value": "JUSTIFICANTA DE PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0234d78-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749550, "uuid": "fccd6d7d-e95b-49d2-9873-ef74f8d64d8f", "comment": "Malware payload", "value": "9582ebb298cf9260ef861f74cbb4cc88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749550, "uuid": "e4501185-3e58-4f86-a035-fe9f00e71b49", "comment": "Malware payload", "value": "0d9516237039b1c01c3d2f5d3ce6daae34beea092d3a74449ee4b03eadb55ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749550, "uuid": "47de302f-a5d1-4b0b-8a68-b566b5f78153", "comment": "Malware payload", "value": "991508ca3c9e5a4159c4be4cccde5a2abbb4047d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749550, "uuid": "213f9662-4fe7-4dc6-b9f0-b637853960cc", "comment": "Malware payload", "value": "e07ca27d7958099f3a25ed2efafbbb59a72812ea7b701e9c4014f5ea77a4dcab972c6022b45d48713043318a0f109e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749550, "uuid": "60544aca-03df-4af8-a675-89b572101b9c", "value": "T11255EB53AB8B0DB6D9C337B5918B931AA734BD25862AEF7FF708453189632C57C06702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749550, "uuid": "47d2bc60-609f-4052-b312-b429db616ebb", "value": "d6593ce1f0eefcf8dda9590f020d26cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749550, "uuid": "8cd148be-b5fb-48d4-9997-03d6a3d21c58", "value": "24576:x+B05hKKcraECrWTPZnq1kMV9BfpvWn+3h3B:3h7cxC1d9B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749550, "uuid": "3c7c4d4e-e535-4239-8150-386b7fbbb404", "value": 1352564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749550, "uuid": "4fa9722e-e5a9-4ef8-ae5a-170dc65920ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749550, "uuid": "b89a150b-0bdb-4717-8f6a-a9fcd9cbbbea", "value": "florr\u7a81\u56f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f39adb0-d03e-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764762621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762621, "uuid": "4a74180f-94aa-42f2-943f-be2968b8523e", "comment": "Malware payload (Stealc)", "value": "1359b6d17a8798361bc943880677d3cd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762621, "uuid": "e3a6d97f-747c-4d34-aa61-eab159a7cbe7", "comment": "Malware payload (Stealc)", "value": "0d9b59bfa29b65d9943c9802643f34d540ac52b8c891e33805c4c681cbd4d667", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762621, "uuid": "887c9bbe-e803-4266-85e9-5e1e17a8c3a6", "comment": "Malware payload (Stealc)", "value": "cb035ee8964c0403ebd531ef85ea07baf7c58686", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762621, "uuid": "1c84a551-9d0b-4102-bf97-44a110e9250d", "comment": "Malware payload (Stealc)", "value": "072df7e48f8bf410f911a891c55f7daf33dce647e76f53fb7cbb6422aa54a71ad1e8b95872f189b66a26c118964ba4e8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762621, "uuid": "2ebc3a74-1867-4e49-ac59-9825a0b80b8e", "value": "T1132512A6FB1375F9C4E145B24CA602F31A216C6B43900F3BB2B0B5295CD635B7E36936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762621, "uuid": "99b908b4-5394-4c88-bdc9-3a3e3aa8d95f", "value": "313a05c8f3f31305e238ae143783f8a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762621, "uuid": "db834dd1-9ae9-4668-ade5-fde057755809", "value": "24576:866ZgI6/YXrGIzy5Ep4lNioIOwBUMT3Iso8xw:8p60r/W5EVoGBUdso8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764762621, "uuid": "b532dfce-2886-4387-890a-af2f6699029b", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764762621, "uuid": "4d3c0a4c-a37d-4b53-80d7-9142996de393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762621, "uuid": "860bf0a3-0972-497d-82bf-785beba6e6fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e49434-cfec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764727705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727705, "uuid": "a040cedc-53a3-4250-b78a-1b59ecf3f26a", "comment": "Malware payload (Mirai)", "value": "2aadd5ee34894bbd2ebbc2389134474e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727705, "uuid": "01f4de64-7b5a-4a62-834b-2b2cddb6cdf9", "comment": "Malware payload (Mirai)", "value": "0db2691197f0cbfdc2b39a26a0efd6d3702873d3565b29f12d8c4e2d4ffbca38", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727705, "uuid": "423650ca-585c-4d9d-9e0b-151ec88d1113", "comment": "Malware payload (Mirai)", "value": "0b542992a43145889ffd0d8ae2fdee85b9a27a9d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727705, "uuid": "fd1f0675-38a8-445d-9b46-a843bfa082d3", "comment": "Malware payload (Mirai)", "value": "fac697744a916b5d37815d21c433fea64bc2b99e8a349808aaf99495c26005023bd76307a364b0da2ce06ef99ca9fdc1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727705, "uuid": "d58a1878-5c2b-4a6b-8885-5ed3460e6a2d", "value": "T14B31A5CA70E21D742CE4EDA731AB48163493E1C664DA5F4AF9DC39FD5ACDD08B054B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727705, "uuid": "e67cfe63-42af-47e9-bd72-f15159f61546", "value": "24:kXCZG+1ZuZI4WueAIGuAITisAIojAI9qjAII+AIwcAIltaoAIArAItK2SAIKR:e0b54NenlroCj/tTtjkDmcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727705, "uuid": "04cab547-ca84-4433-9268-be9b76066c39", "value": 1647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727705, "uuid": "66b075d2-831e-4aa5-93f3-52a9213a2ffc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727705, "uuid": "a1e3411c-aec4-43b3-b81e-0570714eb8e0", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17353722-d079-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764787894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787894, "uuid": "fa52b92a-5326-42f8-ba43-fe3553b80265", "comment": "Malware payload (CoinMiner)", "value": "a2c18e72c92876b17bd9427081bd03c3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787894, "uuid": "3548a7d2-e861-4d32-b2da-9ecb2ef5f841", "comment": "Malware payload (CoinMiner)", "value": "0dd2f8d23e6dbf7bb458a675e0fc8fd7d9f8ef76c8ee1be07540392dba52d261", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787894, "uuid": "9d10588b-0c25-4fd4-8650-df323255a7f5", "comment": "Malware payload (CoinMiner)", "value": "ea3ccd08ee9bc86adf91eafe594638db5ce9c469", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787894, "uuid": "55599688-ed8a-4610-9124-d8b62cc2cf27", "comment": "Malware payload (CoinMiner)", "value": "a6e7bb8a8b369267bf5e914094b750c32fbd39301c1715da3a7ec7d3f4415ae97e38e38db34e1fd881d15057f70a9a2b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787894, "uuid": "cc276b3d-31ed-4b0b-b8f6-0249a84f7c98", "value": "T14207331D9A0D4AA1CFE826BA7ED87CD32E414CC1948CFA6C2697ED983277D148C37359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787894, "uuid": "34d75d05-569a-4b88-b46d-7e8a8f977714", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787894, "uuid": "52ed6df3-e3fe-4f5b-a66f-49553fea5b0b", "value": "393216:wbD8FpUocvWusR1QALmMe4ieMEqDgDz9UcVsSgci:wbDm4uLm5ZZrOsbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764787894, "uuid": "197194cf-16e1-42e9-a4fa-0f4d6f11d34d", "value": 17845760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764787894, "uuid": "4c037abe-7c63-404a-b232-3bcd48391f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787894, "uuid": "e3f5a51b-5003-43b6-9469-336630371dd0", "value": "Installer_v4096_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5578ca28-d017-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764745908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745908, "uuid": "d6a5be63-ac39-4c7c-b098-9532fb792bfa", "comment": "Malware payload", "value": "9e9a2f6ef6b242edfccfece4cade10ef", "object_relation": "md5", "Tag": [ { "name": "purerat32-duckdns-org", "colour": "#36BAFF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745908, "uuid": "2f14796b-6425-47cb-9837-64b73a61b868", "comment": "Malware payload", "value": "0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6", "object_relation": "sha256", "Tag": [ { "name": "purerat32-duckdns-org", "colour": "#36BAFF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745908, "uuid": "6cfbcd26-88d9-472b-b38e-e44a553b0bb8", "comment": "Malware payload", "value": "11a355c4173f3f5bc1d3a1fa0e04e0a266a7ba4e", "object_relation": "sha1", "Tag": [ { "name": "purerat32-duckdns-org", "colour": "#36BAFF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745908, "uuid": "cf3f492c-7470-4522-8a8c-1d6424c6a4bf", "comment": "Malware payload", "value": "05f94fb5818e9ce817ae8c741adcc399c265a856a33fbe932810939f78702c7089d3273eb835721bf8f15f16dcbd1d30", "object_relation": "sha3-384", "Tag": [ { "name": "purerat32-duckdns-org", "colour": "#36BAFF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745908, "uuid": "6dda8d07-572c-4fcc-8e67-ba87ff92690a", "value": "T1E111EF0B6D18D4B64970C0875C64A91DEDC3A413400E5DB1F21D480C9F397BAA5C1C97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745908, "uuid": "7694f1ce-b192-4494-8f09-9a796b595e6d", "value": "24:9A+ssSZh+J4QGMG2k+AcD0rR6nG5CtRMWfej8qWY/Van:eWe+6Qlzd0ruG8tRPfeL/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745908, "uuid": "c6e63e1a-be4b-49c2-b83c-8ef85e8a0506", "value": 914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745908, "uuid": "cb6100ed-80ef-44af-91c3-8787f633248a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745908, "uuid": "9936c280-d0fa-4e5a-8107-9dc3b846250e", "value": "0faf7067e45c2a3289cc58532cc1e31c976d84ea943bbe613f7c95bbc7d715f6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf24ec2-d003-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737597, "uuid": "f2239520-096a-47ff-bd58-5590166a6686", "comment": "Malware payload (Mirai)", "value": "d7417593aade327e7d6d56af17ca8118", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737597, "uuid": "51c1a1db-367a-4258-b45f-60f03c2bbb34", "comment": "Malware payload (Mirai)", "value": "10f9d324058f46433f00c043da6c82512c266a1fca7db8d19a4fe52e0c1bfdae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737597, "uuid": "41e15780-5544-4448-b004-4e65e8256269", "comment": "Malware payload (Mirai)", "value": "06e912ff137aee0b57a9258cfb223ca444627965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737597, "uuid": "05f5d5a5-383b-4000-856f-beb45a0bcf22", "comment": "Malware payload (Mirai)", "value": "c037ea80de4e64baf417f486e225e23b4624e67c4429ec340c1ddc707ed1c06da3d1fe06460e0a067a49987db01d78fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737597, "uuid": "db575cc9-8ab8-4aaa-9a8a-aa09b38482c9", "value": "T13F736BC6A743D0F5EC5205713077B7326AB7E27E115CEA87C769E932BC12542E26A38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737597, "uuid": "cf749a6f-03eb-40cb-a12f-e1631d39311e", "value": "1536:6QCs7Cqzt+CNSQcH+Gh4eY0klcJOoOBOdvtoXhuGzPdB7njs:DB7tzNSQceYnDO/01GxdzPdB7js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737597, "uuid": "13b92a98-a938-48f6-9e3f-9dc1d194b3bf", "value": 75248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737597, "uuid": "928ec07c-e1fc-4c4b-9159-90c0fbc2b6a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737597, "uuid": "043a432a-a954-465c-8351-0322f187ec08", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2802548-d014-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764744883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744883, "uuid": "6b9304cd-9e29-44ab-bd5e-f0ca67a09780", "comment": "Malware payload (Mirai)", "value": "c3f01ae4acd98f296bf4905280a2d309", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744883, "uuid": "3dbc2b78-fb52-4661-8e56-900bd8023d77", "comment": "Malware payload (Mirai)", "value": "10fc366fd3891698f918a76feadf8e07142464719d1cc208dd920d2cf9038257", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744883, "uuid": "42140bb0-a940-42b3-9e6d-a31e1bd1b6ca", "comment": "Malware payload (Mirai)", "value": "520cde31f1da4a6c2a954e877c5b56eb44e49bce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744883, "uuid": "11e09da7-693f-47f3-932c-d5a7e3709b9d", "comment": "Malware payload (Mirai)", "value": "3d4e65a8a74fad9861a1ee973cf67f24b7e31f7a3bdebe1ca836bdc44a68665ebc0a6ef547e25815a8c0ea50943e3425", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744883, "uuid": "5adafd7e-cff0-4716-a444-2826cac40a92", "value": "T18A5184CF51DAA7F0DDB55D9171E94804ACC2F297B4D7DE42E9E824A88C8ED8071D0EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744883, "uuid": "f9c263b1-90c5-4351-b9dc-97012acf25ec", "value": "24:vO9Us9tUR9m9Yhy97qL9t95969VC9X9NX9MK:vO9d9tUR9m9Yw9M9t95969k9X9l9MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764744883, "uuid": "4fec53c1-60c2-4f36-b178-adf353fca693", "value": 2750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764744883, "uuid": "3cea484c-6d04-42dc-b662-96b11018fca5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744883, "uuid": "ada670fe-72ca-4b44-93e4-404bed2e363a", "value": "thinkphp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff43f9d-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764782164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782164, "uuid": "2d73e238-3fd7-485a-8d93-80e34fec462a", "comment": "Malware payload", "value": "c58cd2d6b74c99e7a7f2e34720ef36ae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782164, "uuid": "7c6d5773-6263-44c5-bb8c-7cd3b9b24de4", "comment": "Malware payload", "value": "110094495f3e8481b9255a59407a2febfd63f5f6501c67dea0cc890338216f51", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782164, "uuid": "d6ca9633-a684-4ba5-8f2e-1626e86515d1", "comment": "Malware payload", "value": "7e7ca5d8931b99484d0468f3ac3133c6a041e37b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782164, "uuid": "80174683-c2fd-4efc-8491-4550a763509f", "comment": "Malware payload", "value": "e474e4e987fb83ec77fe8cba5126a8f8a550a1f2a7ecc88ab6f035267e9e5025957ac9ad4abc687ab6ba9e6e2c098f4e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782164, "uuid": "f1c18045-c2a2-431f-9763-0819746e176a", "value": "T1EE4423D24F45A7648B05FFF39884EE93AE780AD8550893F4D8E50EE5FAF0255772208B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782164, "uuid": "5383fd43-e493-4138-841c-0631baa890ba", "value": "6144:V0GVQpsZ8MhG1PD6rFTKzNPlA7iesA1HngB8Hs/0:VTVusZ8cyr6rFTmo7sAK8Hs/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764782164, "uuid": "6a11e629-ea6c-4fe5-b913-dcbecc3cce28", "value": 264205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764782164, "uuid": "5edd990e-3718-45ea-99a6-453a324a0278", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782164, "uuid": "2362f438-97a3-4966-bd29-bbda63160de0", "value": "MouseJiggler_2.1.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536ddb0d-d087-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764794008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794008, "uuid": "7cdf2169-ec23-44a8-8860-d7d592001524", "comment": "Malware payload (Mirai)", "value": "cb7045d4d7b0f9e543f89a255c837ffd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794008, "uuid": "3107c4bb-abdd-47b0-970e-a4063598dd32", "comment": "Malware payload (Mirai)", "value": "1141f183a89c897bdda4ef71892f5d5d5a4a15fac700c337ff6349d95fd1d32b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794008, "uuid": "94d0a5d6-eee9-45f9-bade-f8446935a37d", "comment": "Malware payload (Mirai)", "value": "cea9ae7a6d7f4c78a92326d3cb04ece041988a91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794008, "uuid": "d44bc371-b8ed-4a4f-95a4-96632aacd5b0", "comment": "Malware payload (Mirai)", "value": "49302c4b49177280dc37f39f5de251686ed15b096bed7ec7dde4bf9ea0bd23410fd718005939fa2628c6444a66e16aa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794008, "uuid": "79b715a3-5285-4db5-82a8-89bf98168bbb", "value": "T10543E891F9824667C1D023BAB75E5A8D33A163E4D2CF7657C8204B207B8A94F4D77F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794008, "uuid": "22c94219-46a8-4bc3-bf5b-13d885e01736", "value": "768:rvrFVegVE/XxlQv3Z05MABWjt6hIAUeN0+8dSIheiQxbwdcJ3BdrUAho/rwWQ:Ntq/Xxq3v6htUeN0+85eiHdcJrdBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764794008, "uuid": "4aeeca71-5ee2-4f76-b50b-3f65bb1c7da0", "value": 56096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764794008, "uuid": "90529862-9dd5-40d4-b286-ead273f7ca69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794008, "uuid": "b6bd345f-6909-4308-9e03-857532b74ca5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f59a73-d051-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764770714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770714, "uuid": "7b1a7d30-dd32-49b5-929f-3cdf2015c170", "comment": "Malware payload", "value": "e725b035cf908b40441cce2e87ce6dc5", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770714, "uuid": "af5bc0df-8bb1-4c69-9a2f-5189436a94b5", "comment": "Malware payload", "value": "11e43840ec2f4fb57b635ac0f8a445ef1f6f2ac59b22999e2dc9e7bf0ea7e939", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770714, "uuid": "fd641dc1-d762-4bda-9441-ca1f0156545b", "comment": "Malware payload", "value": "95e762bf781fcc6bd09fce7c0d410e8f4f8bd393", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770714, "uuid": "3a937c1c-9b75-4f2b-b3c6-265ce76e7176", "comment": "Malware payload", "value": "159a1e72c3c9c1e161b8723da43f3385334ac5920e2cb07c780bbe06748fb9ff2565a170c21d43c26fb6769a93a21c02", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770714, "uuid": "dd7b881e-3c89-4e1f-9d26-d80085bdfdd6", "value": "T15836D0D07E0AA140DE99BFE9E25FEF0E92182137CFE1DA0910C61B560CB72957F9D660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770714, "uuid": "0580e485-854f-41ad-886b-c97585f196b1", "value": "6144:aQN3v+YsA44W65X4bpf+0AmawDQ2aD3d7Qcli9FoV1Kl:uGqk2Lcli9OV1Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770714, "uuid": "684e5c46-18b1-4ba6-8905-67f3eca0cedf", "value": 5226337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770714, "uuid": "e0763386-24f2-403e-a0b5-0f72aaff84b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770714, "uuid": "ef009c88-e6d5-4718-b386-b3a3ffd9022d", "value": "sample.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed931ad-d009-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764740179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740179, "uuid": "52ad223e-098e-4623-95e0-8e44498b60d4", "comment": "Malware payload (Mirai)", "value": "4626b56d847f7ea021ca475834eb17e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740179, "uuid": "cc2066f5-7f27-4369-b1fa-0b83e3b08626", "comment": "Malware payload (Mirai)", "value": "12fcf1fb8a1956ee882a6503366522566ecdf2a955d3c41b8be0c30bca651363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740179, "uuid": "5785c839-b870-4054-8bc4-6bdd466d76d1", "comment": "Malware payload (Mirai)", "value": "1026f923d8f6bd9160339b3b06c99419ea9f8e6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740179, "uuid": "297f104e-b4dd-4dc8-9b37-bf15b7c3c8b1", "comment": "Malware payload (Mirai)", "value": "00258ebddad2a8219a5d9e1dbbf827c73f8f124fe3e26ffedf70a16f58db07810a489529800a44be9b0b650ead58de96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740179, "uuid": "7a5277ee-45be-4bf5-ae85-c8cf9f968224", "value": "T1B414E85DE4608B3AC7D1217AF795428D33735F28EBEA330949256B343BDB6295E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740179, "uuid": "6710af16-d909-447b-bf91-ca0ac3a7adf4", "value": "3072:rqsYZPDmLKJullvgIEEWVWsL1NrUU2dzYsVs17bXcs+7GH:rqsYZPDmibIEEWVWsL1NrUxjG17b/+7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764740179, "uuid": "24e15607-16d1-42a1-8a81-f27dc10f22e3", "value": 196352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764740179, "uuid": "b263ff04-ce6c-44f2-b4d6-ccabf2540a93", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740179, "uuid": "c54e76ed-b92e-41bb-9bc9-fec59e135086", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28127f27-d008-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739389, "uuid": "c04dc88d-53e0-48a3-b86b-50e29cc07a4f", "comment": "Malware payload (Mirai)", "value": "48af33692fcbbecead1bfe976f7ccfb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739389, "uuid": "d4ebe744-92b1-4a21-a565-16f892febb60", "comment": "Malware payload (Mirai)", "value": "1325e41b40715ed657ef6e842f28b468581b3ffca30017f46220b8b473521d7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739389, "uuid": "d1dbf262-47b5-47f9-83be-5d1a7f9f60d7", "comment": "Malware payload (Mirai)", "value": "5fa1047598fae2a83a5f224c321fa38c8dea8471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739389, "uuid": "9bd44886-4c2e-4d1e-8615-896f11158dce", "comment": "Malware payload (Mirai)", "value": "d240cb37a16349129e943bdd7a2567abe9a6420c306050c695f72e8138d31b43504bfb71cbed42d3a8e9defcd31ca3ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739389, "uuid": "940c0214-51e6-49fa-9907-d16829bcd26b", "value": "T189047DD2BA5E7D7BD2634E3FC64243556F3CAF008E02251760AE728B29BB1D10F5674A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739389, "uuid": "07f46e35-ea42-4804-9094-1b07d0fbd80c", "value": "3072:FXBpLiW5GSHS/Vf6Hs7pyTkvBL14/Vho+4ZYGYrAeLfzw:gWJIVCHap/vBLS/VmpZYXAe7zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739389, "uuid": "7fa93fc5-e896-4876-abce-b6449b72d7e3", "value": 183940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739389, "uuid": "c60dfd5f-49db-408c-95db-fc942789578f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739389, "uuid": "cd048b3e-2e1e-42f8-bc40-1d55fcac9c29", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9094777b-d071-11f0-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1764784662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784662, "uuid": "ea167efa-2eab-4da9-ba0b-00f61411449c", "comment": "Malware payload (XoriumStealer)", "value": "5342143429937867c76f0ba370ec0d11", "object_relation": "md5", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784662, "uuid": "cd668289-4e11-47d8-93e3-bc9d54e05d1c", "comment": "Malware payload (XoriumStealer)", "value": "13f221b634e9dd9c174c975dca5680fd4d856d93977152235e3f6a9fe0e059bb", "object_relation": "sha256", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784662, "uuid": "456d4664-3b16-4323-b0f5-602bacac8be2", "comment": "Malware payload (XoriumStealer)", "value": "937a986a31aea9bf1f375da98edde6d50c2b6921", "object_relation": "sha1", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784662, "uuid": "f84edee7-c672-4c68-9d82-cc50dd172eb5", "comment": "Malware payload (XoriumStealer)", "value": "3346c411fb874441ab9258ae467188c30c93010f64b11d7b272f923a8b48e87dbde73d07b44b8de74df7a676e8d5f9d1", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784662, "uuid": "f1fb93c0-8f4d-4ff4-8e41-5ef409e85841", "value": "T164966BE725E1B6DEC116C5FA9712F97F864FB0B9461AF5A3F044B22ACA13C807258F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784662, "uuid": "9dd31227-71e2-4f36-a8ea-7011c3394af3", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784662, "uuid": "1bbdbd3f-1637-4e9c-b6f3-3bc7c2283c29", "value": "98304:vMcSUsKZFxOC5LRsMZK81bRCnV18Ck9nL+fFyJKZ+DE2j3h8QrKQjdWPqf/:V1sKROCRxEWQ4C84Fy4oDpCQrbdQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784662, "uuid": "388a87b0-8ea5-4f2a-a959-6564957ef3fe", "value": 8821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784662, "uuid": "ba25a5d0-6bdf-4ca3-9859-0a78ac0ae06b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784662, "uuid": "388a0a82-c42c-4f66-ada6-266195c21183", "value": "13f221b634e9dd9c174c975dca5680fd4d856d93977152235e3f6a9fe0e059bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29046e3-d054-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764772317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772317, "uuid": "4f42a7b2-df65-49ea-8486-ad28f59cc191", "comment": "Malware payload (Stealc)", "value": "3a86f0eec0a8e2be0dd62f1a7b755d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772317, "uuid": "971d4581-3c67-45b5-a51c-f4782d1b3f84", "comment": "Malware payload (Stealc)", "value": "13fa7d9111462ae97d2d41e6879b0d3ee2ed5f8ec939dec4e56bd209e1e85b1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772317, "uuid": "99a68fb3-f051-40df-ac19-a5f12baa5245", "comment": "Malware payload (Stealc)", "value": "018b2ec69b4db026a1121cdfda6d4f3f157c822c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772317, "uuid": "76f7e517-c61f-412b-931e-4a08881802c0", "comment": "Malware payload (Stealc)", "value": "972d63a3bfb74b34d389c1f9c3f9a21c6662abf3a30a1a0402d92bdd20c9fc1e5d3d0c951edc006aac1ed27c18aa7854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772317, "uuid": "0af99ae3-ae6c-4dc7-bea3-6d0ca35bd86d", "value": "T1DE086B4667EA04D4F9F79A749AE65213C673BC063F30D5CB3208172A1F736E09A7A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772317, "uuid": "8d730830-b4c3-4115-9597-f8a996066f69", "value": "75cf84d4df4a91bcc923afe606315555", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772317, "uuid": "bef6bdeb-9991-40fe-9eab-55f4afd033a5", "value": "393216:+mtDmI1r26dJZZ0T9Fr5phInzYivPfq0OdNeQcQu58EASEhoIaE2lShGD1BE6xqk:+EjlCtcQJhU5ZqoVNWvxOOxoh8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772317, "uuid": "e447f8ec-5711-4eab-a16d-46690b16a3a4", "value": 83017835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772317, "uuid": "4db4d625-30e1-4a0e-ba72-d8ed350be31c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772317, "uuid": "5698dfdb-66d1-444a-a153-6167066b5202", "value": "n3k8r1p0zu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604e19a8-d080-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764791023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791023, "uuid": "b0ba20c5-8099-4e67-a12a-37862c9ab1b5", "comment": "Malware payload", "value": "2d04869e2c3acf4526ddde069dc468b1", "object_relation": "md5", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791023, "uuid": "f27ae2c1-1ad8-4161-8efc-9c08c3de3c98", "comment": "Malware payload", "value": "14696459e30e7255c3d2fd19e74eef304aeff19f3af5acfd540fd7ee049ee045", "object_relation": "sha256", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791023, "uuid": "7c8b8b32-7fb0-4446-b18e-dfe779da54f2", "comment": "Malware payload", "value": "5a63dbcf3af3d1ebc497ddb7e72d79c6b1b954f9", "object_relation": "sha1", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791023, "uuid": "2f87e0d4-ec3e-4315-8f8c-76a5576b41f8", "comment": "Malware payload", "value": "4569c9c5fd6e3c154e601bcbc27e0cdbd2cf5dc2c15647a08b3ae00cc5acf0e7f268895dc40c0a903e6ecd4e94a6445c", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791023, "uuid": "55afb11b-15e7-4c65-be11-c96650e36f68", "value": "T10CE57C22E24388F6C2265638CC2B57885525BE532F64898F7AF47E4CDFF92F13D25192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791023, "uuid": "a8e398aa-f0f7-4d11-8db2-ddb551bc8fd8", "value": "d7504f5455f4552cebf22a95de6cd27f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791023, "uuid": "e1f5422e-d176-48bf-a3bb-5ce89522adf8", "value": "24576:aVVNhLXetfQGKRb1ohHm9j9rP0gH4tpFM4gDhHZQ4lPB7xLrOazS+5h+2b+9hqHv:aVVep6bkYFhB7BLz1g0+X6TBePva7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764791023, "uuid": "33125fc1-cbf6-4850-9aa8-d28db2ea83b1", "value": 3083168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764791023, "uuid": "76b29bc3-963b-4ac6-8770-2f12a850affc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791023, "uuid": "894cbe52-6b11-460b-bad0-c3b5389dec9c", "value": "ProgramData.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ee0c5f-d095-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764800134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800134, "uuid": "695d9f6a-aad9-4e43-93ae-58c4556519a9", "comment": "Malware payload (Mirai)", "value": "b55833f9d01d17f703be8973e646096f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800134, "uuid": "18ac994f-cefe-48c6-a4e3-cef6c60e26cf", "comment": "Malware payload (Mirai)", "value": "14fb9997a02cd65be6dd6422c5109b6bafa0fb306135c2b799500360fd936d54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800134, "uuid": "68f5bc8e-01a0-4deb-b5c5-dd2a09feaffc", "comment": "Malware payload (Mirai)", "value": "92d8de4715773b356b141477be0e455b60f11262", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800134, "uuid": "6d0f453c-9e9d-43bd-8f1d-4d89a48759f1", "comment": "Malware payload (Mirai)", "value": "223e3a48a2a983fe1d7005e9137247bc98eaed73f5989d5216f322563819430e3baf6300a06ef65121fbf6d18305fe91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800134, "uuid": "cf1381e6-5998-4e32-a4b2-66dd4973309b", "value": "T1D5C36D31B4381A27C4E4647B12F78726B2F617CA11A8CA5F7E720F8EFF115402A57AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800134, "uuid": "12bdc4ed-6f4c-4e59-9d14-9ee02e848ebc", "value": "1536:t1wCTXeNMLVwRbHwPplP4eVtO3ZAr55Wxc9pHUDzhvF1PyQdWFx4jowUt8xl954j:3TerjS55wht1KQIAqixlPFMY7yy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764800134, "uuid": "709dc619-9fda-48c1-82d7-86f6bad205ba", "value": 121192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764800134, "uuid": "59afdb04-bf8c-42ba-b6bc-12648d7411e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800134, "uuid": "504d3192-a950-418d-9bcb-5e2bd7700523", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ae8863-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746816, "uuid": "71b9f22d-e0f0-4dd5-b5d2-6cab07e5694e", "comment": "Malware payload (Mirai)", "value": "9c13427b156b1b2e5f4d75096ca41264", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746816, "uuid": "239b0aa3-d356-417b-b04f-2e02a4742741", "comment": "Malware payload (Mirai)", "value": "151ac329ae310dfb04c56227b1dbd901bee5ba48700702c568b8989010ff726d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746816, "uuid": "08a1c4ce-b4d1-4767-9652-484b100c4abe", "comment": "Malware payload (Mirai)", "value": "dfa2ea65b3ee2500b2048736f6cc128d3951024e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746816, "uuid": "c1e6b43b-9d68-48a3-9f19-28e3c4016235", "comment": "Malware payload (Mirai)", "value": "6418b4240e6da7145e7aca5d9af519b1ed50a8dd8844d67fb3dba9d19c6a02d9416411e2709d0282a76743c8734c21c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746816, "uuid": "c9a8267f-0a19-4c67-921e-df48ff33463c", "value": "T13923F13B02125073CC6B9AF90B6037B1393C0D7A796BDA4AA642C5F1BD1B8A6D4747F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746816, "uuid": "460605b7-d2f8-47a6-b872-3770630955e4", "value": "768:v6jTdhisHDFnls2LeUmAv8+rV88vVu5+YZGzxPE3MPo+uykptFhHxP7RigvBu8/Q:vITrFlzBe+/gAEMPorzptXlRDvA89Vq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746816, "uuid": "ac7a4aed-5f2c-4f36-9ef5-5e3b3b5457c0", "value": 46144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746816, "uuid": "abbd1c76-8cdf-4dcd-86e4-cbad1955761a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746816, "uuid": "542b5e2d-63c5-46e0-9b68-ba75afff81c0", "value": "Yboats.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac28a053-d071-11f0-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1764784708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784708, "uuid": "dd6d9905-3f35-43f0-bb49-ec586dfade0d", "comment": "Malware payload (XoriumStealer)", "value": "e0f510758219d19850dbeb6e0075d27f", "object_relation": "md5", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784708, "uuid": "3edd6c90-737d-4ff6-8a67-d3d6f93ea417", "comment": "Malware payload (XoriumStealer)", "value": "15c319e00eb4a3007195d255861e25498e501ecc5e0c6638d2f48bc9c3ae2e73", "object_relation": "sha256", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784708, "uuid": "08380f8b-2d3d-4732-a095-40e3c456b754", "comment": "Malware payload (XoriumStealer)", "value": "69c27b7d7c74f8901e20d7e8c03fee544cedeeef", "object_relation": "sha1", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784708, "uuid": "1cbfad47-9242-469c-8854-e184ba2f3f00", "comment": "Malware payload (XoriumStealer)", "value": "9f94726ea2c7e11893db542373227c5c1fe5da226d8ed9756a44b1a62d3093e1297a5d6b5a394916b4141f41c9e6dcb1", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784708, "uuid": "36a46fa1-d9f3-4f4d-8c24-d0e7106a1c46", "value": "T160965CE335E1F6DEC21AC5BEC212F87F8BCFB5360A0AB1B3915462968957D40B214F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784708, "uuid": "0acc6a6d-abe5-4774-9ab2-96d5565fd4f2", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784708, "uuid": "973220c8-3143-449e-8da4-adca6a110ad4", "value": "98304:FMcSUsKZFxOC5LRsM9B1WV4s4Uo5kPBhvP3F3ba0WHCqzadP7phuHenHobgUKPFU:v1sKROCRxr1ls25CjLa3q7PNHobgjFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784708, "uuid": "e4b83b93-d6d8-414e-bb72-37f143c81f85", "value": 9231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784708, "uuid": "2569c189-dda0-4160-8e14-dac7ac6f0b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784708, "uuid": "96a74d5f-f0d3-4c88-a11b-656e6c97c723", "value": "15c319e00eb4a3007195d255861e25498e501ecc5e0c6638d2f48bc9c3ae2e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0a821d-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736393, "uuid": "9f481bb0-f787-4c1e-886d-263c3630cff8", "comment": "Malware payload (Mirai)", "value": "3ebbd22ca4b5650ef5a29a14f1e24beb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736393, "uuid": "9e713bf9-6fc1-4934-aafb-18872fa6ccdd", "comment": "Malware payload (Mirai)", "value": "167ce3a4ca94634be5e43460f415e497ba03e81f8d0ed28c91d7569167df48b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736393, "uuid": "3f9babb8-b92f-4c92-9c4d-29f5875b9871", "comment": "Malware payload (Mirai)", "value": "8519f9bbf4208f53ab5fea03eabc5f682c742515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736393, "uuid": "7b8ac14a-e4f4-4ccd-abdc-54e563868d8e", "comment": "Malware payload (Mirai)", "value": "50e8482a7e694a4331585a4f7c9a00a209ec65a8c034a681b2532c105207ac4f1344a9393446d80111a70ce38ab8c76f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736393, "uuid": "3e0aadb0-f7c4-4f14-8f4e-6948fc25448d", "value": "T1C0738D23C92A5CA4D54948B474A48B345333E619C0A72EFB66ABCB769847ECCF51D3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736393, "uuid": "a134c54c-d5d6-49ef-b989-f8e50322cc1e", "value": "768:w1SQPQjfsxqx8wLfAuaDAlab3LK6N9UgC0azUmKMxgQTjayoYpck4CeDoB4fT7t5:wQjsxqxH8olMjUgZAKMxgfFYj4CeD7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736393, "uuid": "2c420589-f514-4b7e-b023-4c4030d5b55e", "value": 76492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736393, "uuid": "ec05ea94-cc97-4f90-8d6b-8fb43edf9e91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736393, "uuid": "218ff390-4886-4796-b02b-52ae48feada0", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2589aa64-d05c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764775463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775463, "uuid": "d465e3d6-d63c-4afb-a83a-50941abd1214", "comment": "Malware payload", "value": "7a737c2038ff1fbaf774054d64ea955e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775463, "uuid": "c51f6cdb-4f3b-43b4-9df2-d2ee9ab59377", "comment": "Malware payload", "value": "16e0dbcc6670e7722f68620b6f305e2c4433ed6f7b25174a75480ed5c4b4fe42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775463, "uuid": "ba741987-6c88-4259-b91c-573ff41ddd5e", "comment": "Malware payload", "value": "8b24f0fa8099c5d57eb05275e5b3d3ecc589f9a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775463, "uuid": "7f2b3b1e-5d50-4294-84ac-eaad9cac3e5a", "comment": "Malware payload", "value": "701c4bd9a2571bd182024eccf33b8cb5a6916fa10f1d0d1aa94c49e017c8a91dec4f54bfed54bc85e2a306d84a0c48ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775463, "uuid": "30762848-7469-4c25-b280-b22789a10cf3", "value": "T1C673A52563C178A922475F73772DB2E9E619ADAC30540CEFF404FC48F7A651AD6E8A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775463, "uuid": "feb6e604-d80e-432b-bebc-08ff5846d153", "value": "1536:lg6LjgJ7vYVip2ETgj+uFmsCryupxmurh6+ruyOFe:lgojglKiIEbtvrph6+ruZFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764775463, "uuid": "8d7f818b-d2dc-47b6-9c31-134b60b059a1", "value": 77525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764775463, "uuid": "7dfd62ff-ae66-4f86-9021-e8b37c7e7b87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775463, "uuid": "0b0d62bc-c33c-468c-8965-e8987d68b6eb", "value": "Oliga9zefa0nebebal4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7390e395-d052-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1764771299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771299, "uuid": "1c225f8e-063e-454d-9bc9-a92517d3b521", "comment": "Malware payload (GenesisStealer)", "value": "bc5b0a131afbbdb1f56e38e9376af959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771299, "uuid": "6c016ed8-504b-4405-8811-a5e35334cdbd", "comment": "Malware payload (GenesisStealer)", "value": "1715bffc46bace588a5015bcc089fcad4d9905d6c7ed8a51c4d2ff970f3fe692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771299, "uuid": "5c09b27d-3493-46bc-aaa5-659eab7eb190", "comment": "Malware payload (GenesisStealer)", "value": "62625707863e1e5d418b5a6603bb10e26d059225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771299, "uuid": "54e9bb39-3195-479d-9afd-8c1f9d6a936d", "comment": "Malware payload (GenesisStealer)", "value": "698a4a5458288add1c7c727577e48b884e9740a34f04865da9562aff26119ede2552ea92b3c85f7dda6fd938576c22d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771299, "uuid": "52751cd9-ee13-4f4d-b327-00b4c7193d98", "value": "T11C1833537DC0FEAAC48DB23F67F925B918958067AFA3373A1141C5AB305CC896B31A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771299, "uuid": "67478595-bcdd-4ce1-b5c0-efceb375b9ea", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771299, "uuid": "b8ef61a5-c65e-4663-9ba9-5fcf4284d55c", "value": "1572864:gLg+BWMFDe45kkB36hDRVOuPMqjJTlLMOJD2Z13nYcxWqQ0OQhA775:kxBFle45whDRV/RjLwSab3YFQOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764771299, "uuid": "461e1eec-86b0-495e-ad7c-8f6e198b00c1", "value": 88377372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764771299, "uuid": "04d84629-f95a-4d05-a822-82c852402965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771299, "uuid": "76de378a-fbc6-4ba2-b9ba-88205030d6bf", "value": "Rooted Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409de69a-cffe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735136, "uuid": "d0d4482d-4ffc-4879-8620-3ae778a39b50", "comment": "Malware payload (Mirai)", "value": "178bcb5ab6c71d9e1e63d3930cfbfe53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735136, "uuid": "ae64a339-7566-4d0b-bc68-9c2691ba2946", "comment": "Malware payload (Mirai)", "value": "17c55e7c88aee6d0717c6c2733c837a14b2a58f429ea15e982d21cea3a9c9f7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735136, "uuid": "dcc6ef22-caaf-4e3e-95d4-9f5929379df8", "comment": "Malware payload (Mirai)", "value": "a1d90df9e500204780deb7defd46a86f8f5e6dd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735136, "uuid": "d6faaa6f-4362-4811-a641-34605ce25a12", "comment": "Malware payload (Mirai)", "value": "21ab065e3ba1f9f47ee76eff3d32dd809c4cce93f3ef9131910031ec305a3c7d3e72426a212c135c433b2516a611351d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735136, "uuid": "b1801221-68d2-406a-8606-9a42c85ae7aa", "value": "T133836C02B71C0E43C1661EF02E3F13D5D3EAEAE111F4FA85650E9A46D1B1E73168AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735136, "uuid": "b4f78ae9-1779-4938-80c6-a1594ce5e864", "value": "1536:2DhptBZwTTiremVDJJgVAPCOHeE+2PA5k6Z7WWCUYC/b:khpriT0gWeEXa7tCeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735136, "uuid": "82ec5238-4dee-4603-b512-9cb69488eaac", "value": 83704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735136, "uuid": "8de6a4ef-5631-4bc1-a872-73b9f2b6a44b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735136, "uuid": "b6b51c78-c88a-4cf1-9979-6de98c350b83", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df00ff1-d071-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1764784443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784443, "uuid": "58247d3c-7cde-44ed-aab6-c6e3191172a2", "comment": "Malware payload (Rhadamanthys)", "value": "7b7e236c2bc0bea4fccc47b9df46308c", "object_relation": "md5", "Tag": [ { "name": "45-153-34-36", "colour": "#1E58DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784443, "uuid": "a4b87f99-6b2e-4150-bb2c-cbf04ec14797", "comment": "Malware payload (Rhadamanthys)", "value": "17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-36", "colour": "#1E58DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784443, "uuid": "9eac121b-710f-4926-9a3a-03693f29255b", "comment": "Malware payload (Rhadamanthys)", "value": "2a1f9c2d1cbdd9a123ecfce2a205655f1624f19f", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-36", "colour": "#1E58DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784443, "uuid": "643d770e-54a6-4eba-bddd-7749c47bc975", "comment": "Malware payload (Rhadamanthys)", "value": "bd3a178775f98da9dedd2e5996ca2ec818a726a70eacdc2c536597ca5e2581c1b6d8467191d1403f7d8711713b2d283e", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-36", "colour": "#1E58DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784443, "uuid": "2dc969f6-9439-41b9-8ba2-a83b66183d2b", "value": "T16775339775B242AED95117F065B6F6930497D9A14C31DE2EEB40E8CC2F60686CC3BB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784443, "uuid": "2b907e30-c63b-4e4e-90fa-8ba8755ec687", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784443, "uuid": "19733993-4d58-4c7f-be8c-4b3fd9cc1c65", "value": "49152:ewy8g1tahTuvNZIV4vhI0uNP9Mbuy4hr7jTJn+br0L8tmOpL:w8Cta1rV4J4NlMbuy4djTxM4MBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784443, "uuid": "a5a969d7-b57d-465a-8a10-b6947e8b944d", "value": 1623349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784443, "uuid": "2c80272d-d0a3-4914-b6ca-172d84804f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784443, "uuid": "b8d215a9-4d90-4cb0-a8f5-e8dfddfa39f5", "value": "17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38faa416-d079-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764787951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787951, "uuid": "7ec8b684-46d9-47dc-96f5-febbc30f0729", "comment": "Malware payload (ACRStealer)", "value": "00c70fe113fbba486e9b539bfdae3d33", "object_relation": "md5", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787951, "uuid": "2dc2dd6a-9ff1-4136-a462-418c722e61ef", "comment": "Malware payload (ACRStealer)", "value": "18794a9b9d04286144e5ca91fdfec3c18da1860f17267ed68fe5e4ce3bbf993b", "object_relation": "sha256", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787951, "uuid": "7f932197-8e76-4edc-9d5a-0848d3deb4d6", "comment": "Malware payload (ACRStealer)", "value": "76cbe7c3eacb10d397fc9f483a89032c8ad0d3f4", "object_relation": "sha1", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787951, "uuid": "39b64ed1-043e-40c5-b6fa-030f527e0ae5", "comment": "Malware payload (ACRStealer)", "value": "aa31b31333beccb8a4cc9c7d04d7e0225c2f2ae35d867e71b12f010d38224c4f672431cc73ec8bec190134d3b225b000", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787951, "uuid": "f2f5d2be-7552-4b0f-af8d-266ebc9213b1", "value": "T154D633AC2D769894F63544B4809B7F37E85B0821DB83819873C5E281C5F7F6E9BB8C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787951, "uuid": "3a236784-e956-4dd1-aa40-0a48193df53a", "value": "393216:V2A2i7WWFRxd9j663XtBjskpXKuT55T5ROA53/j12o2:VvzHx6IVswnbOo527", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764787951, "uuid": "3da2ad50-54a1-4ab3-bd35-7c9acd444c67", "value": 13271393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764787951, "uuid": "f7bd5e06-d6dc-48d8-807e-435285fe6ad1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787951, "uuid": "e1a6097d-ede1-432d-99ff-8a93755dabc1", "value": "Setup_1764755978508.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0300f7a-d011-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743456, "uuid": "0eca38e7-6ae7-41f8-aebd-45945314186d", "comment": "Malware payload (Mirai)", "value": "1f14a89cd3c8c39c28d8d60907794c2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743456, "uuid": "c256a2ac-0d8e-49da-96e3-b301c0ffea52", "comment": "Malware payload (Mirai)", "value": "187ad4f4f841d5531cc777d3f1a1cd075c44dc6eef7285c1af39efee74ff18f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743456, "uuid": "9fde61b8-e26a-48e0-99ce-215862ecfa6c", "comment": "Malware payload (Mirai)", "value": "05504e4a0d70f4f4f2cb026b0c6186f96fbbd079", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743456, "uuid": "ef3c1f04-57fb-4c38-8f58-8b0cff0b92da", "comment": "Malware payload (Mirai)", "value": "174faa1c4f099fc6dd7ed89443a7fff099a1c271c26a1c3c16b810bd6f5bf8c8165f5279fa1409d65c9a741f5361ac91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743456, "uuid": "a1ff3e63-fc33-41c9-bd59-e0c6686de2ec", "value": "T18723F192734EE2F8E810ABF128976744E5427ECAF447179A0CDBE43E51389477EB1E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743456, "uuid": "4ed0a7c0-13b2-45f7-8357-40c8be28e45d", "value": "768:SLUf0YgT2wop/M7atlguuwWrxe4WbpH97Q4WU0bVxcB69IJPCTbPx0X9:SQ8YE2X5Mas3ELpHi4IIJk+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743456, "uuid": "c329d8aa-aca7-430b-981b-bdc9da40a5ae", "value": 47604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743456, "uuid": "11b07766-21ef-419f-8157-b6dca619335b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743456, "uuid": "f2e95992-d877-4778-a649-638d177d99ff", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb64de2-d093-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764799289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799289, "uuid": "53f57e2c-6641-4201-9669-d9cd4d221e75", "comment": "Malware payload", "value": "b207a9590450d5d7fa606c95e59e77ca", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799289, "uuid": "89207569-bf99-41d3-a793-d4c6b240c6fa", "comment": "Malware payload", "value": "18a796c33de87e9276f217807c91e96d39c092d549fb1dae1fd30c05b8c4adb2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799289, "uuid": "bd5b23b3-1a35-42a2-b47c-8e55114680ba", "comment": "Malware payload", "value": "c677e647bae4f9401126334e4d1e99217041b8c1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799289, "uuid": "57920c6f-e962-44dc-bde4-903cf1645d97", "comment": "Malware payload", "value": "848003d77237e0c33ac8d5e52a37a37949ddfc0b376a476b45f1cf7121b135d79f59f3b102011ce901e4b494c6a28125", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799289, "uuid": "1ffefcfc-6ef9-421a-9dcc-486b4c658804", "value": "T1C4F2B0245B052B61CBE8841AB0AE8D4777F4C6CF2307FDCCA112ED6A2D8B60B521B4DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799289, "uuid": "eda2613a-6ecb-4599-9e90-c2aaddd84048", "value": "768:opbdfaWegX64/TFZncHk/FFegFyfOHH6+KZO9tEE+qz:cAMTPcHoFbFyo6+zt3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764799289, "uuid": "9e6a4b3c-5bf7-41e9-a912-d28baf22e730", "value": 36150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764799289, "uuid": "b7aa3e85-3e07-4f61-97cc-8af9ac00b243", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799289, "uuid": "68435758-9aec-4f04-95ff-2bdf050596e6", "value": "voicemessage_expir.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c7f460-d089-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764794878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794878, "uuid": "701ddd85-0280-467c-ba63-b5a2f1955dd9", "comment": "Malware payload (Mirai)", "value": "98b3eb87e7d0ddcb64e0221faa917425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794878, "uuid": "46309d10-a8ac-48ba-91b5-fa0ca63c093e", "comment": "Malware payload (Mirai)", "value": "18acbb856db7eeabcb318bbecc61fceb3e71fbd3e2bad2a98320fd092dbd002c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794878, "uuid": "3aad63dd-5392-4a5e-b0fe-fb6984a568ca", "comment": "Malware payload (Mirai)", "value": "05a5a9a54f03175c174966f73b58560768db2168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794878, "uuid": "1dcb3323-7993-4acd-be0e-55032a91082c", "comment": "Malware payload (Mirai)", "value": "8991a9a057a6970e2c99e84b80186bc18e4e52742acda3fb5a6eb0c6794d4ec9e187a731c1eb69dfa2bda11df1b260da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794878, "uuid": "819a6291-e7e4-4d5b-9c21-c189c118eac7", "value": "T18C934A22BA7A1D27C0C1A47A21F74B21F6F247DA25E8891B7DB10D8DBF256402157FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794878, "uuid": "cfb509fd-e667-41de-b7c0-cec827fe8f11", "value": "1536:ZOXSQ1pxh1OIKtsasJZ7tlHwRhOYCF0VFtqSMGN+b5E8ZnkaZRthFZ/:ci+p/g4ZYAaFESMGNOE8RJT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764794878, "uuid": "3487dd37-24e9-4df4-bec8-29e9def6768a", "value": 96528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764794878, "uuid": "265eabca-7b81-443a-b3ad-2af11f43ee31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794878, "uuid": "577b628f-f44f-4444-9840-1216e377b03d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7228db-d06f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764783855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783855, "uuid": "b98f2d05-def3-4645-87fa-b7d600bfb5f3", "comment": "Malware payload", "value": "e506f1cc11f133d40e9f8781304692d3", "object_relation": "md5", "Tag": [ { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783855, "uuid": "c8488196-71b1-43c8-a762-9debcccab8ae", "comment": "Malware payload", "value": "19801bfff10fc0605820a7d7bf7a5cdbe07073188eec8308f62f228a7a0307c0", "object_relation": "sha256", "Tag": [ { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783855, "uuid": "424c9967-607d-4b52-8324-5ae1925d81c2", "comment": "Malware payload", "value": "2a8f43aced21de2b24d128ca308df2a5ac3d8516", "object_relation": "sha1", "Tag": [ { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783855, "uuid": "7a11c02c-ad8d-4543-992a-170c4ffcc86b", "comment": "Malware payload", "value": "212e259b8accab00a5278d290f93b32fdf81307215f5896e31c267be650351f15a6edd0ea6b64571188ef09d2add2910", "object_relation": "sha3-384", "Tag": [ { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783855, "uuid": "4f4a3364-f65d-42ce-b7d7-d4a9744dade2", "value": "T1FC187D13B3A704D5E8F7DA7496E65223A932BC062F3085DF324C47261F73AE05A76B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783855, "uuid": "5022ba3c-a701-4441-b790-049ce4d4f177", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783855, "uuid": "12967c14-ae40-4856-9d10-d95697cbb0f2", "value": "786432:npNzhI+nsVt6mHaIvAN6v+s4pgPVlcmg:nDNI+nsPcN6v+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764783855, "uuid": "82b33c87-04fb-4c18-bc1f-f5bd8965885f", "value": 92171776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764783855, "uuid": "9a843a0f-877b-4c78-b456-37531e527ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783855, "uuid": "10767f32-ba3c-4fa2-9e57-83c16ff8c8de", "value": "cherry41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb09c54c-d07c-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1764789538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789538, "uuid": "46281deb-2682-45bc-b7e0-722313d4d053", "comment": "Malware payload (OffLoader)", "value": "116caa672371172886c0ee13f7772341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789538, "uuid": "2f5cd3f5-027d-4973-a096-c77a3a1fb773", "comment": "Malware payload (OffLoader)", "value": "1a4279bf33cd9302c4aae6e05ff9d9ef2de1ddc83da1518a8a2f84d241873f9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789538, "uuid": "6a4af435-f823-44ed-9949-e6315a806ae0", "comment": "Malware payload (OffLoader)", "value": "cda2ac846a5be0cf26c01df10a20dcfef0f5a0d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789538, "uuid": "42aa0923-1a1e-4351-a0a4-9f824d68011d", "comment": "Malware payload (OffLoader)", "value": "aef220deea4445d311ea5e62fa2eb91827ce50498ac93dee90880af19d07bb76434d089a1314491c0e17d7cd9f7185c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789538, "uuid": "a584f4cf-5011-4a53-9a65-c64d36c961ca", "value": "T19B95CF33F28AA73EE06A5A3759F292505D3B7A21641E8C4296EC3C4CCF791601E7F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789538, "uuid": "4a4a4851-aaf3-4b80-a7ed-7d0abb57311a", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789538, "uuid": "36b27d01-aa4b-4bb8-bdc2-af9a831d51bf", "value": "24576:cX6N6JCGN33/T15ZWi7Knsz86f+nqWU/Wr0VUw9jzy3+nILajv12fJO6xxvZSABG:/N61T1mIyqWUWr0VZ9vFnIL4kOSxhpVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789538, "uuid": "1add7d5a-430d-4c5d-88cf-6476c48777d0", "value": 2048731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789538, "uuid": "6d74d64d-596a-4dcf-a309-2c84391c49a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789538, "uuid": "f5d51ff7-5d2f-456a-801e-6323c027fa4a", "value": "116caa672371172886c0ee13f7772341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8bb957-d07e-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764790185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790185, "uuid": "e618b622-2df3-4182-9159-a0ccc17f6d07", "comment": "Malware payload (SnakeKeylogger)", "value": "5f7754af29cad82bda6c0bde6868de00", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790185, "uuid": "cd2b2561-d17b-400d-aa77-0bf29fdff479", "comment": "Malware payload (SnakeKeylogger)", "value": "1af798187ccd530ab462315516d800d78f3881954d620b3f4585c3e1468da3f7", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790185, "uuid": "d7dcd681-6a65-4acf-af7f-50d24348be69", "comment": "Malware payload (SnakeKeylogger)", "value": "52c17b299c13b4da597e26447a20c6459067d33e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790185, "uuid": "67caab19-faa0-4df5-8bfc-94894cecaae8", "comment": "Malware payload (SnakeKeylogger)", "value": "55d6bea961eca9c66464cb3c6e6c69f47964592591d8a2c5085e8344de611ce56e1b7453778489d4dee571b82259ac95", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790185, "uuid": "55a436ac-b3ee-48ae-8154-1e13bfb1476f", "value": "T1F86502158DC46FB9CFAC4A1880FE160E93F04A8B542A7989FB7B7D46AFF7544020B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790185, "uuid": "0b7eb54b-a5be-402b-9a28-2a9983689e94", "value": "24576:M39wRnxFfRJlQaVCEJgsIkgCOpCCgwbKzQhVpHQfbvQ:MtwRvRjWCM9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790185, "uuid": "1ef8a5fb-b73d-449d-a7d9-8cfcfc2fc58f", "value": 1435878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790185, "uuid": "e4f072d5-824c-45ab-8601-2d3f6d419da8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790185, "uuid": "fbad1a62-0bbd-46f3-bd17-ca4f7215dd11", "value": "M136236_20259283-INVALID BANK ACCOUNTREVISE INVOICE .VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727a7f67-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746816, "uuid": "e2c1b57e-51f8-4cbb-a8a0-aeda288db1d8", "comment": "Malware payload (RemcosRAT)", "value": "c002276badfe40d3aac67db224871c42", "object_relation": "md5", "Tag": [ { "name": "blindersxorrect-duckdns-org", "colour": "#F6129B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "setforsurerealz-duckdns-org", "colour": "#AFD159", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746816, "uuid": "22b1ba23-f60a-4633-a6d0-f0f57404c413", "comment": "Malware payload (RemcosRAT)", "value": "1ba2ad3eedead37291686edb4ec971cfeeb5aa774be2b709b9f616897fdfbf7a", "object_relation": "sha256", "Tag": [ { "name": "blindersxorrect-duckdns-org", "colour": "#F6129B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "setforsurerealz-duckdns-org", "colour": "#AFD159", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746816, "uuid": "8d4ca1f5-fbe2-468c-a623-3b3790d0c8fb", "comment": "Malware payload (RemcosRAT)", "value": "7a672f4cdef0cb83fa4a909d02273b778b26599c", "object_relation": "sha1", "Tag": [ { "name": "blindersxorrect-duckdns-org", "colour": "#F6129B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "setforsurerealz-duckdns-org", "colour": "#AFD159", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746816, "uuid": "71d91be7-1ac2-4c76-b2ea-141524065601", "comment": "Malware payload (RemcosRAT)", "value": "08dfb256ef4b1fc8162cd9b2c9f257a3031a640018046a3ce93de42de221a118d2e0fcebe36723be46cf1f1f7114ab15", "object_relation": "sha3-384", "Tag": [ { "name": "blindersxorrect-duckdns-org", "colour": "#F6129B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "setforsurerealz-duckdns-org", "colour": "#AFD159", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746816, "uuid": "685ab09e-d273-4f75-8d6c-c3be49af5f9a", "value": "T159B49D01B6C2C1B2D1721D300825B775CEBDFD2118759A7BD7DA1D9BFE301A09A39BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746816, "uuid": "c4214a15-2178-48c6-8af3-5d4741d644ac", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746816, "uuid": "04c7b7a0-48d8-4576-a014-eb42dc896c58", "value": "6144:7zD4yO8Yt8Ja0OGkxWC8bwvgrVmaGfBhLzPJgr4YrrBFdLlSV7QsAORZtCX92ScO:IphpG48wvGVgfBh47r1UQsPZtrmPFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746816, "uuid": "aa33f70e-7c98-4542-a794-814e657d85e9", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746816, "uuid": "78ecd20c-bb64-441f-b09f-24aa0f27149c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746816, "uuid": "95d73600-4291-4436-bdf2-bb2d858cfb11", "value": "1ba2ad3eedead37291686edb4ec971cfeeb5aa774be2b709b9f616897fdfbf7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f323041-d091-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764798269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798269, "uuid": "49a44c05-a546-4e30-928d-308417629c1c", "comment": "Malware payload (Mirai)", "value": "03a5e7cc97e622cf7a49002ae5c1f8fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798269, "uuid": "29ffec20-7843-4a0c-998a-10de60d589c5", "comment": "Malware payload (Mirai)", "value": "1c2aea124ce87ff532cee797ac53450a221d0e7d16d0d3a244274dee3fc515a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798269, "uuid": "cb63bcaa-43a5-4acd-b013-e8beff043295", "comment": "Malware payload (Mirai)", "value": "1fca977b13f39a0560aac5c45a0eb6ca32141b18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798269, "uuid": "e22c9f86-c3e2-4a72-ac01-ad92e8598113", "comment": "Malware payload (Mirai)", "value": "6ef3ad45642276269a7a5c7661b28b710fe64281273109b2dca3f3e19a26880f3af15e848ad9ddbb6c3cd3bbbf7b8f99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798269, "uuid": "20f20dc9-1fdf-465a-8068-b94d670f4500", "value": "T11E2301A747EA8F04C446423C59AC3FFE1FA5B58C6B6C05794EC8022B199C79E79343E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798269, "uuid": "57b9be19-7c77-4a0d-9bb1-54c6c25d24dd", "value": "768:TcSc0T9CojkdwXtmiKoZaQO/Vzg9IbFn79XqvGjvBBajOHvjAzngNQbgwB0hanbF:TO+Co4dwXtpKoZa/VqCXXqvCvmqHvEzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798269, "uuid": "61604093-e880-4533-a605-ab8e8c86b71f", "value": 46728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798269, "uuid": "3e52bb0c-1088-4b53-835d-ec8dc4915518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798269, "uuid": "91839295-f255-4f2c-b3a5-5ba2b996c788", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb93891-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1764770616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770616, "uuid": "94b59a78-1c57-4a4a-8162-034f4ba4d73e", "comment": "Malware payload (DBatLoader)", "value": "22b201742d08b572ec54d756d48e9086", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770616, "uuid": "f84b0226-9451-4503-8e34-4da4ed8b0cc5", "comment": "Malware payload (DBatLoader)", "value": "1d2b96df0f0f1c65ddbc1bbc1fcb8f498d28caa97d2847e3163424c3a68c9f27", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770616, "uuid": "b1223362-8da5-4b60-a24b-a5157fd211c9", "comment": "Malware payload (DBatLoader)", "value": "c862f68c64f9c32f280cb2643e0dc6e0197cd9fe", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770616, "uuid": "7f83bbff-315f-4f29-8d33-d18284524705", "comment": "Malware payload (DBatLoader)", "value": "c9d72393d2a25d3e64252b50c0ac2405cb7ad42e63df6a0394fa40f9bf2354fc46305d17832a1db1ff54ef85d7c37b50", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770616, "uuid": "47711193-369a-4a2e-96d3-62990af26825", "value": "T18765D066A1F08436E053CAF58C16D3896829BEB43E75A85A37DC3F5C9F362742C26173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770616, "uuid": "0f1226d6-4dfd-44ec-aaf6-a02dde05ef86", "value": "eb41e5567017c33839f07ebe2eb84cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770616, "uuid": "7f05e600-180f-410a-9a80-821a9d3ac77a", "value": "24576:bbCbz7++IfUFixpw0QB7FqyJGOYNZqBH9JNnO1xLDg35mI1MZiFzZSp40cEirHIA:bbiFjbPqyJGVNZqBH93OjLM3z1MZiFzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770616, "uuid": "18642d63-37ff-42b6-8e15-451062c1b09c", "value": 1536000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770616, "uuid": "c128bf81-7802-473e-8ad2-752d02134dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770616, "uuid": "a8041f72-cf39-4e34-a7e6-1668118bb033", "value": "Vzdievvpwgceqxv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d500853-d008-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739398, "uuid": "0e8ed5ca-e9ea-4587-be3c-6456f084e284", "comment": "Malware payload (Mirai)", "value": "758a25e6b9203144eca6b12906e96d9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739398, "uuid": "30e4c9fc-3881-4c27-aa2d-9f50e587fa07", "comment": "Malware payload (Mirai)", "value": "1e9eb027d920ff43990e78a73cd9ccd1ce8e1f13f0f0de2d92001533389c96ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739398, "uuid": "881a0927-1265-44e7-a1da-fb61ee060b7f", "comment": "Malware payload (Mirai)", "value": "e458622a6f00d7e9b362835dcc14d234ad259456", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739398, "uuid": "22523f33-5e7b-4359-b222-92e357f9fd8a", "comment": "Malware payload (Mirai)", "value": "5e52957fe0b07d6d294a88a702a9d391517fb3aaab1bbdb4417a9b070470bc194a0d932834b4c573783862d6a252bc80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739398, "uuid": "af850790-4026-4bdd-b156-7a595eb23534", "value": "T1EF342985F8819E26C6C512B7FA6F028D371A13F9D2EA7103DD151F6137CA85B0E3B686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739398, "uuid": "adeb5c25-f380-47af-95a2-b4fe2f21c15c", "value": "6144:mKqB4691dO97Osqsierb4zOlyPLnooI+n:mXB4gsFb4zOwjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739398, "uuid": "b535cbf5-2c71-4287-a036-ce386f541138", "value": 250592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739398, "uuid": "50455792-b0c3-4508-bc3c-2e00fecb05ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739398, "uuid": "5ac80e11-b14a-43bc-887c-1a5dfaf93cb5", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc94a0a-d04b-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764768120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768120, "uuid": "8ce23559-2c0c-4dab-9d70-9ea5b2dc5947", "comment": "Malware payload (CoinMiner)", "value": "ab943920f96a90e50a368e128a8717ce", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768120, "uuid": "b17aec12-5fc8-45c1-b00d-c8f37c4a4bf3", "comment": "Malware payload (CoinMiner)", "value": "1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768120, "uuid": "4a984686-a2d0-4619-938f-58cedd731fae", "comment": "Malware payload (CoinMiner)", "value": "858d8b4a31fa746a85c9c8336d59bd5a550a8086", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768120, "uuid": "43ab73e5-6894-4e0f-bde5-01d94394ff0b", "comment": "Malware payload (CoinMiner)", "value": "075c32de78b96bffde8d29214798edd264886f8f88c35efe510db1d2094020f0ea0dffd8d7a35e6e5bce340f6abf33c4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768120, "uuid": "3fe6f971-b796-4a38-accd-93901eed87b7", "value": "T1DAF533AC5C6110F0DB3E8E39C3A3EB24993F75598B52ADDF067432554A227D3BE2681C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768120, "uuid": "8155540a-d0d7-46ec-b4ab-5a74b660d952", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768120, "uuid": "eb52ce01-1886-482d-ba25-1d6dfd76fd29", "value": "98304:qGOpZ5mFCugjTYsy5TVG9KkZ3L3e0gsp+e:qEsy5TVG4gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764768120, "uuid": "42056fcf-63f8-4bee-b196-61f9bdb9fe61", "value": 3436344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764768120, "uuid": "0f5a896f-aa9f-4c41-b0b7-5b45c761be86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768120, "uuid": "302a9fb2-92d3-4488-a785-ef5f26ad8630", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555d798d-d018-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746337, "uuid": "e40139f0-b330-4707-aa4d-a369928f7bf0", "comment": "Malware payload (RemcosRAT)", "value": "f15f6a901240ee0ea283c3a91dc6e77e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manymandyills-duckdns-org", "colour": "#BA73F4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746337, "uuid": "aeec8664-d0a5-4fa3-850e-5b471cc92168", "comment": "Malware payload (RemcosRAT)", "value": "2001f036444665272ea360854d4dfd7d0798d6a717d3a1806e856b7d48531ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manymandyills-duckdns-org", "colour": "#BA73F4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746337, "uuid": "0b4db758-de10-4d8f-98d5-00c71fef7939", "comment": "Malware payload (RemcosRAT)", "value": "62748c736f5746940aa26dbe5c4d17bd00859b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manymandyills-duckdns-org", "colour": "#BA73F4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746337, "uuid": "74b0a67f-25bf-431e-8c18-7ea41fa56121", "comment": "Malware payload (RemcosRAT)", "value": "04a5d35b17e5e88c06a1d6ba5fbed698a2ef802096c6b11eeb952eb464f1a333cb2e399adf0785941eb361539a79f3cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manymandyills-duckdns-org", "colour": "#BA73F4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746337, "uuid": "1c16040e-aa2d-4f2f-aa75-4902ca9d0d84", "value": "T16DB4AE01B7C2C0BAD572143018359BB9CEBDBD202835997B93EB1D9FFD34152A6397A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746337, "uuid": "b458b139-699f-466d-bfa3-2a5c65966444", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746337, "uuid": "2754ea80-ff81-45f1-adb0-a01fef951906", "value": "12288:uJJxHbxGI8AvmOHJpA7D9OCsPZtqQmPFN:2Jx7xx80e7D9wZmPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746337, "uuid": "7dc6e3af-6648-404f-b6cc-3087df8931fd", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746337, "uuid": "94e26ed1-df65-4ec9-a3a6-c6d8d86bbffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746337, "uuid": "b6414dcf-7d59-4131-889a-da698da617ab", "value": "2001f036444665272ea360854d4dfd7d0798d6a717d3a1806e856b7d48531ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a1e3c0-d063-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764778436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778436, "uuid": "cfcfdd61-5daf-4ea2-b616-20f0906453c4", "comment": "Malware payload (DonutLoader)", "value": "50702876ca0152ef5bf89c632661f1f3", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778436, "uuid": "f05e7ae0-79d7-4013-8f82-005557d03f74", "comment": "Malware payload (DonutLoader)", "value": "20291af59067a9886fa2c749d711adc8c2ecf687a48611cbdfefe6b5ca0f583f", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778436, "uuid": "7fc3083f-8514-4f3a-b3ee-3e91a758894b", "comment": "Malware payload (DonutLoader)", "value": "98cf00fbf71451e29bbf86683a180a63dd397471", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778436, "uuid": "6a7c3911-8c8a-4a92-8cb2-212328084112", "comment": "Malware payload (DonutLoader)", "value": "dd5de5bee90e0d5fa75493f136ea7386f232136e127458801327cb6a67b6390ac812b2d81728be6d8dede1e361474b1b", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778436, "uuid": "cee74d6f-35b7-45af-aaed-1d6e4b3fbfd3", "value": "T127548D15BAA810FEE977C17CC9428906EB72BC464761E7CF13904AA62F277D09D3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778436, "uuid": "138bb962-6240-4018-8b34-e9ec5e2076d1", "value": "53e19d5243b4f25d48df742c8d94ac9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778436, "uuid": "d4ab510c-db79-4488-afc8-af9932d6b82d", "value": "3072:9fRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlHCxFUP:9fRbGY6EDNNAuHe28Pl2ncxliyR2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764778436, "uuid": "ee648277-5618-4b4c-bc29-8e783218662b", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764778436, "uuid": "a0bf471a-58e2-4a7d-936a-cf28edf481c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778436, "uuid": "0e906ff0-6d5f-403b-beee-cc01ef478eb7", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f73f0a3-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767373, "uuid": "9673df42-6cbd-45fc-abff-edfe999a2fbc", "comment": "Malware payload (Mirai)", "value": "c49ea7104d9d97d96de240b63517758a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767373, "uuid": "f9208fff-fdc4-41a2-9aae-c52f342d5033", "comment": "Malware payload (Mirai)", "value": "204953b9e484199daca5c847d593d73ca5019fd55060cea016b42eedadfaaaf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767373, "uuid": "8c118add-ff44-41a4-9f03-bb8fec437dfc", "comment": "Malware payload (Mirai)", "value": "e75b63dc05eaa4d6af24a77d2d803020bf301460", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767373, "uuid": "59e83df0-67fb-4464-aa6d-08dbfe25dbf5", "comment": "Malware payload (Mirai)", "value": "3b0c3db41c3557738e72c8f146b15f6dc36563ee4ad6c4065bdc1fdf2d2f99d2344cac77730bc1a8a0165d6308299b8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767373, "uuid": "e3a8a8dc-60f0-4f4b-bb23-acf86980726c", "value": "T1A6634B42B31C0A47D4635DF4263F27E193AFA99120E4FA85650F9B8692B6E331186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767373, "uuid": "d80abacd-e0b4-49f4-9015-23a7c9d794f9", "value": "1536:LmalL/z0vzXfvIf5hnsfkbFOHXSAr8Yfz7GTU4IQLQ+8fByW585sFEh:5eOyDL4IB+1pJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767373, "uuid": "e9f5eb1e-2e39-4397-bb9f-d00ebfa312c9", "value": 71244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767373, "uuid": "7dcb0050-711b-4221-835e-ba286863f08a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767373, "uuid": "bb02e66d-8b38-45ff-9284-8f75587c4904", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c87235-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746821, "uuid": "e775408f-6eba-45b0-b725-480129562bcb", "comment": "Malware payload (RemcosRAT)", "value": "85ba2d9871f22806111f0d239ef7e70e", "object_relation": "md5", "Tag": [ { "name": "blindersxorrect-duckdns-org", "colour": "#F6129B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "setforsurerealz-duckdns-org", "colour": "#AFD159", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746821, "uuid": "2f5095f8-20f7-4248-a6be-7058b62ddf1c", "comment": "Malware payload (RemcosRAT)", "value": "2082c1d125619d7edccdba1bf86203f7da375e20b8a66698dad29e239e1cc539", "object_relation": "sha256", "Tag": [ { "name": "blindersxorrect-duckdns-org", "colour": "#F6129B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "setforsurerealz-duckdns-org", "colour": "#AFD159", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746821, "uuid": "99cbc92f-0592-4976-ba38-6198575ce812", "comment": "Malware payload (RemcosRAT)", "value": "2fd3802bff4d675e5fdb628f6ddcd0cacbf753d3", "object_relation": "sha1", "Tag": [ { "name": "blindersxorrect-duckdns-org", "colour": "#F6129B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "setforsurerealz-duckdns-org", "colour": "#AFD159", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746821, "uuid": "cd62e6af-75dd-4754-87e5-a4dd624f7eb6", "comment": "Malware payload (RemcosRAT)", "value": "f17bc24da4c16beaa6524cd81184ab7bef6b192a445905e82c2dcaf63339a4c37637090608b692f87fad9eb4a0bb015e", "object_relation": "sha3-384", "Tag": [ { "name": "blindersxorrect-duckdns-org", "colour": "#F6129B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "setforsurerealz-duckdns-org", "colour": "#AFD159", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746821, "uuid": "dc6b037d-b9cc-4330-a3be-3239b11b110d", "value": "T1D3B49D01B6C2C1B2D1721D300825B775CEBDFD2118759A7BD3DA1D9BFE301A09A39BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746821, "uuid": "f4219786-9d43-4e00-859a-2bcf54aa36bb", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746821, "uuid": "6da163bc-4736-49a2-ade9-ba30fba90c13", "value": "6144:BzD4yO8Yt8Ja0OGkxWC8bwvgrVmaGfBhLzPJgr4YrrBFdLlSV7QsAORZtCX92ScO:aphpG48wvGVgfBh47r1UQsPZtrmPFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746821, "uuid": "4cd23ef9-3d47-4314-b990-bff12a0aebb5", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746821, "uuid": "2baded6f-622c-4d06-a2a8-1a6b4874da64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746821, "uuid": "5eaf25ed-75d7-44ad-a6c6-691d4ec53f3f", "value": "2082c1d125619d7edccdba1bf86203f7da375e20b8a66698dad29e239e1cc539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebe3b25-d094-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764799638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799638, "uuid": "3796d3da-9805-4b7d-816c-431f474cb65d", "comment": "Malware payload (Mirai)", "value": "50a2b2fc38051ec4ab31caf390c1ec9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799638, "uuid": "8a8ca065-1052-4b66-bb31-312e1e05bc5a", "comment": "Malware payload (Mirai)", "value": "21ac5563cde511f024577ec38b888745db32793e8b7f54228d2c3cce67d0502c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799638, "uuid": "34909595-892a-4e81-8906-862d66305c2f", "comment": "Malware payload (Mirai)", "value": "75cf998dfcdbd1b302ae8bdf02c86f08beaa8553", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799638, "uuid": "8e1f62af-686b-4cc6-86c2-93a177a9ba69", "comment": "Malware payload (Mirai)", "value": "f466d4601c77a5d600a7da94f2965a4d6faaf7efa5283d46acc92d29809388a1098efb8737fc25d99650d08de1f63a99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799638, "uuid": "896cafab-9311-44c1-968b-0c804c3a3021", "value": "T16E0633FCE138ED54E100B169636AE528E049D03A1DED7DF00B587B5AC73F225EEB2562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799638, "uuid": "f83976f3-78ab-41ec-977d-a0aaca77f8c8", "value": "98304:4db2OT1t9ROChzrH/lsY8vjUXIcDdFlUF:S2I1t9xluvjGRUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764799638, "uuid": "cea409dd-bc7e-4580-94f4-554ee3d0c786", "value": 3678832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764799638, "uuid": "965c9f2e-a9c6-4a35-9824-00674861cd0e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799638, "uuid": "dca8edbe-8900-4bbe-a76b-71e5250fb14b", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de247fb-d033-11f0-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1764757975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757975, "uuid": "2bc9bef8-0083-4e00-b96c-d814ab7373e1", "comment": "Malware payload (UmbralStealer)", "value": "a5ed4bbb4e0930e2b6a8c099f0c1e512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757975, "uuid": "e30d16ad-8154-40c7-9eb6-96506afe3129", "comment": "Malware payload (UmbralStealer)", "value": "21bf530d180ac2a214028fc62c4dfbfc6aecc0ed87210c208a0f0759af520a90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757975, "uuid": "14054e78-b027-4e50-9624-611ededece1d", "comment": "Malware payload (UmbralStealer)", "value": "b5d7a1c191905349ea46cddb1665b8e64fe8f316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757975, "uuid": "1c4b0e74-3cad-4d2c-a4ee-519b9acbb3f8", "comment": "Malware payload (UmbralStealer)", "value": "bffebb798d1d6ca8ea00bbc848f98a059af03dbba66d325fd992db00eadc0fccf9f1809b340da419989308d36b8d258d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757975, "uuid": "95e1b20f-ea19-4653-8b04-b9cd5142ae38", "value": "T13F346C1437B8CF12E25F9FBED9B1549F8B71F103E81AF78E0C88A5E81551B42E809A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757975, "uuid": "023117f2-1641-4fb5-899a-827169181451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757975, "uuid": "bae44918-def8-4565-9b7e-62eda2bd48a3", "value": "6144:RloZM+rIkd8g+EtXHkv/iD4SxtQCls8e1mBwKi:joZtL+EP8kYxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764757975, "uuid": "e1a78990-c61e-4ba0-9205-b166d29afc81", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764757975, "uuid": "d24352bc-6ec0-4012-a281-cf1e98803dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757975, "uuid": "b13b55b8-9744-45ea-b4ef-0ea196cc4403", "value": "skin-fortnite-checker_and_generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3e4eb3-d054-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764772365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772365, "uuid": "8f0a8cbb-130f-49f5-870d-d20449398e8e", "comment": "Malware payload", "value": "2f467804ecf70a04bc6612b17d4ff369", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772365, "uuid": "0cb99050-7e2e-49d6-b1c4-3f2afe03c9b2", "comment": "Malware payload", "value": "221450620a27b4d25bd71d63ec4d87f54a6540068e6755f100d5f45a3cd57750", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772365, "uuid": "aa6ef305-c333-482a-97f3-8f40c8aadbb6", "comment": "Malware payload", "value": "93c4964711defd97692eb85226d39434409da44a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772365, "uuid": "4756951d-c924-47e2-a682-475e8fb17327", "comment": "Malware payload", "value": "785dcb3efb1b826bada2b19830141632f230c2e4aaa2c3ce05519e0d07cca91ea944b804ee4763913202164eff83eb8e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772365, "uuid": "f12dce22-26ce-4005-8670-91a17fa29050", "value": "T12A3623237383C73BC99A42704E6A97592179E8F30B2090D7B7C8684DED655D1A7BE3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772365, "uuid": "b8c5bf85-1646-430f-a967-822d6b621636", "value": "98304:WUWma9fQ0x685ErY9BLnCrlhLTGuotrarhto7mSp0IQf:WUWb94nPrY9tnCJhLctrar3emz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772365, "uuid": "037473a0-2698-428e-9fad-45b996e64a2e", "value": 5287936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772365, "uuid": "bc329d42-97bf-4f94-a13a-7c8c17673f20", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772365, "uuid": "fff756f2-a96f-495e-bd94-1b3f41534efe", "value": "RateConfirmation_193715.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4574f467-d066-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764779811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779811, "uuid": "185a6504-71c7-4a3f-9b61-2abc283e2fcd", "comment": "Malware payload (Mirai)", "value": "3ab9e492dbe6836c19bc5b6105dae651", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779811, "uuid": "062bba8d-1844-4413-aa5c-ec3b6d193a1a", "comment": "Malware payload (Mirai)", "value": "22225ac56d5b1e5cc24ec6a09623d49b9d64148bc88509957687f80d1f5ab6eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779811, "uuid": "d2911868-0669-4d4c-88cd-9519ab7705a4", "comment": "Malware payload (Mirai)", "value": "7ce926ec3b5a0d3fe1b2d706779c743f67d80790", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779811, "uuid": "efbbbca4-0864-4288-af4e-6fc12124c6f0", "comment": "Malware payload (Mirai)", "value": "9f98f13ccaa7506edd872994637f24eee86a828fe4af6f7949523c8636181ce381bc28c12b6a59183b01a2863e81f883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779811, "uuid": "376e1822-21d4-4fef-bffc-0ed14a420656", "value": "T18613024393A72B6FE06F94721B0CBA892CF181294409963DD0FC125B9EB273ADF74557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779811, "uuid": "9d056571-4981-414e-81f4-ed29e3b0e4ae", "value": "768:+rSfhEid59nixEMei/cy6/wGibPiyvEBNi7fEb/S5pihStM0IjljnbcuyD7U0yqU:BhfdTiBei/cRiLigE2zEWLi5Pjljnou1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764779811, "uuid": "219c83b7-9ed7-45f2-be4b-aee919a82b18", "value": 44616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764779811, "uuid": "44afd59f-3cb3-4ff5-87bf-2379d6b1a377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779811, "uuid": "96470fed-4026-4c04-8ea3-10b5deef4c7b", "value": "Yboats.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a9f0bc-d045-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764765830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765830, "uuid": "80ad5ee1-e8c2-47fd-babd-2a90f2551d05", "comment": "Malware payload (ConnectWise)", "value": "25b9f932612076eae6ee1c652d9f1972", "object_relation": "md5", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PANTALACCI-ESSINDI-EDANG", "colour": "#DEC13F", "exportable": true, "hide_tag": false }, { "name": "rnicrosoft-im", "colour": "#4D7510", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765830, "uuid": "dfb2e549-6013-45c7-aa15-00c63f073efa", "comment": "Malware payload (ConnectWise)", "value": "22cecdac0559b894455c71f4b461fde92d4272444a17db4b6da23606efb0e7be", "object_relation": "sha256", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PANTALACCI-ESSINDI-EDANG", "colour": "#DEC13F", "exportable": true, "hide_tag": false }, { "name": "rnicrosoft-im", "colour": "#4D7510", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765830, "uuid": "72b8f69c-1a26-4311-be45-96758a462b5a", "comment": "Malware payload (ConnectWise)", "value": "467307baa0c6c3cb79d209ac983b9a5799a33c0c", "object_relation": "sha1", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PANTALACCI-ESSINDI-EDANG", "colour": "#DEC13F", "exportable": true, "hide_tag": false }, { "name": "rnicrosoft-im", "colour": "#4D7510", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765830, "uuid": "9ee8c1cb-d82e-4d7b-a423-f56a0307d463", "comment": "Malware payload (ConnectWise)", "value": "9e3017d994225851d7096b12237d995e5ecd60b7748e4c439e7b653b2863622e4f787c46b98affe27a588075e32c1d4d", "object_relation": "sha3-384", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PANTALACCI-ESSINDI-EDANG", "colour": "#DEC13F", "exportable": true, "hide_tag": false }, { "name": "rnicrosoft-im", "colour": "#4D7510", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765830, "uuid": "73acb049-c4f8-4a84-abab-8aabfd803f3e", "value": "T143A6223267F94918E1B36778E93991F295367C65CF12C08F2764786E6870E8097A333B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765830, "uuid": "41df7cb8-70ee-4429-aafd-f8cb6ab537f9", "value": "196608:hrnLYG3zFhukOernLYG3zvrnLYG3zqrnLYG3zErnLYG3z:hbDDFgvebDDvbDDqbDDEbDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764765830, "uuid": "88010a52-151a-4d9b-90e1-ac1b79dacb64", "value": 9977856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764765830, "uuid": "1fb8d2f6-6823-4ccd-a493-93c5c4603e0b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765830, "uuid": "5025525c-177b-43f8-a51e-42a7100093d9", "value": "22cecdac0559b894455c71f4b461fde92d4272444a17db4b6da23606efb0e7be.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95faef8c-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749452, "uuid": "843b8aeb-9fae-4c67-9a71-3f9b06c7e23f", "comment": "Malware payload", "value": "1b41fa36915e92079eab0a70b5c71ffc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749452, "uuid": "49360849-c69f-4b23-b9a4-22a416024421", "comment": "Malware payload", "value": "22dd514e77f6f5a853e889471777a763c72316a4f68a612ea03a52121d17247d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749452, "uuid": "e9224e2d-814e-4e8b-91bc-c7bd46ecf3a9", "comment": "Malware payload", "value": "0343a62dc7e1a104578056ac9ef6d371a13a3236", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749452, "uuid": "9821b30d-8062-4e2e-b7bd-3de9b9053b8b", "comment": "Malware payload", "value": "d7c7712678a2f1871bf4c061a8740660b492ebdaa80f0682d8b88ab48b1f8d6a27121b8a476f5fbcd91dbefb64ad9eff", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749452, "uuid": "f2332a89-c4d6-48bb-a509-3ff9c41cba79", "value": "T112461286F706947EC4F742364632176612679C2A8F83D783299D723C2DB76C84F9AF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749452, "uuid": "7f1cd536-07bf-4889-8f77-a60ffba1a9c1", "value": "98304:eu6g88ar3W4JHX9iQrb9JchRqRiEnxig5ju5dk5LR6EmURVh7XrnwX:euxwJBWpUxiK6n4LRmUpf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749452, "uuid": "ff1f1a44-6868-4333-adf5-fb661fe6dd3d", "value": 5393565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749452, "uuid": "674d6dec-b43f-4dc7-bf86-4861be9b6179", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749452, "uuid": "21e4aabe-ea71-4ffc-8011-0851169c1693", "value": "ACTED.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc227991-d03c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764762079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762079, "uuid": "d9108e66-8049-48cf-bd3a-1f3dfc0d352d", "comment": "Malware payload", "value": "9d9f00786de610281920f59e7fd19573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762079, "uuid": "bc886b1b-ae9c-4e96-b398-2bd67d522d5d", "comment": "Malware payload", "value": "233eafff1151fd0215671666905334490e7206265995e9ea025db700655bb69e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762079, "uuid": "9b34fb24-6194-429c-91c3-ef86fcef4f4a", "comment": "Malware payload", "value": "85fca2fbf3e3da205740be47a915c4d6a06e826f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762079, "uuid": "ec830ddc-af53-4a2f-9440-dbd1d2093f19", "comment": "Malware payload", "value": "9dedaa92af2b1937b3093b9fb5f8622d9c12a8c4322d7f1d62299d99d7a8264623241bbd9711e97bbeca76a90c184cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762079, "uuid": "10b4f2d3-ea36-4f78-8a42-e68e3f8eab44", "value": "T130A3AF0BF38580F3D404863018DDA3B7E23AFF116FA0618AD75B5E5EBCB5561B609CA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762079, "uuid": "084997ac-7d88-41a9-841e-8797c1102d93", "value": "12a4fba455b427624820df9d73ca2405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762079, "uuid": "2437353e-5e52-413d-b778-6b625d747010", "value": "3072:Ok9sHWhPYy7bwLBKxYpWLjciBB6q5yDeNg:Ok9P2y7bGpKc3q5yYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764762079, "uuid": "5667ed4c-63be-4125-bf4e-79dc3ec50950", "value": 99977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764762079, "uuid": "53c99d3f-10b7-411e-8709-b6b52326b560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762079, "uuid": "fa49015e-f86f-4e66-baa8-b8c6e43f89ed", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e875724-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1764770351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770351, "uuid": "ef959284-77a4-47c1-b62f-0600c014c115", "comment": "Malware payload (BlankGrabber)", "value": "ef323b67ed1257c71e18e4c7c10d0575", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770351, "uuid": "7424e49c-9545-40ab-8ff0-e3ef2e742747", "comment": "Malware payload (BlankGrabber)", "value": "23ae50d51a908d1ccdad1cb7750b6b63596cba85731883eb40c5cb9273ad61e4", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770351, "uuid": "1d8a773b-5162-4abe-b090-8c83c13f5961", "comment": "Malware payload (BlankGrabber)", "value": "e6f8ac6f42a618037d49e01ca9785d7f545ab29f", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770351, "uuid": "1f620055-bc6a-4f20-9575-a5dfa2286546", "comment": "Malware payload (BlankGrabber)", "value": "f76a7fe1f570c74a2892fd46b5288fdc483e22223b2c26bab27c261e63d668c65ea3937c614afc2afeae5006ec94af44", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770351, "uuid": "9f1122d3-bfd2-4085-854a-064a70a333d8", "value": "T19CB6334957A605FBEAD3993E8933C936AB77FD911BA0C3CF036453242E135E1093A726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770351, "uuid": "9555370e-6ee9-49a0-b312-dfec432a5ba2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770351, "uuid": "f289cc50-8542-4a04-bad5-b47cbb615577", "value": "196608:ILidFbyd0oej9fZwQRCgafs8rDkfCRcb+3oy14ZAM9qxixR3DbMyDndkys:ILiECw84fsekfxb+3oy14Z/w6DbFkys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770351, "uuid": "830e469e-ef00-4243-927f-1ba30120013f", "value": 10643921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770351, "uuid": "1aecb878-5a31-497b-84af-8e49f23a537d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770351, "uuid": "1e7d9789-2766-4311-88af-1ef0d6fdcbb3", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b1cdb2-d080-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764791064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791064, "uuid": "d8ca25f7-676f-4b67-963f-ca36c202ccf3", "comment": "Malware payload", "value": "5dc9adec552665516b8e3ad478d5b162", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791064, "uuid": "58beb01b-e647-4c0e-a2a8-efbc5091f850", "comment": "Malware payload", "value": "240afa3a6457f1ee866f6f03ff815009ff8fd7b70b902bc59b037ac54b6cae9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791064, "uuid": "9ce12433-b146-484b-b076-eb8c00c878bc", "comment": "Malware payload", "value": "d9de239e81e85cc0ccd4c2d53c94f509d673d6b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791064, "uuid": "d839ac9f-4a14-40f2-91e2-958af63b6544", "comment": "Malware payload", "value": "a190a38539172e4ab7f0c905e6673dfa0e32d9110aae56ccaada9f56ed36acf76c33383499417b8898892ee3433340c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791064, "uuid": "6566d94d-073e-4385-bc28-58851a8ea6e9", "value": "T1DE2633405C7264A3A5CC036DADB5B384E6D3A45E50CCAB66EDBBC2827379FDB4A10235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791064, "uuid": "06c8df17-31ce-4f5b-a7f1-52fbb4194390", "value": "98304:JaIGAQDQIJuNhJhaMWKfYo4lCCSQBHxeFAY8Dk5XJ1TTP1:vhNh/TWKfR4MnYIzTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764791064, "uuid": "ddc4462f-dee0-4fea-ad9f-918c8299640f", "value": 4740104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764791064, "uuid": "e3873dd5-2d95-42be-8c01-025838ec050c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791064, "uuid": "3e57c56e-6a6d-42f4-b945-c0d5f2b9015d", "value": "crond", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9f4413-d095-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764799980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799980, "uuid": "3a79d849-7403-4b2a-a917-c8d09568660d", "comment": "Malware payload (Mirai)", "value": "bf220359e49a17bd3982e6be26d59a06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799980, "uuid": "05768403-14a0-439f-be7f-6454d32e704c", "comment": "Malware payload (Mirai)", "value": "263a363e2483bf9fd9f915527f5b5255daa42bbfa1e606403169575d6555a58c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799980, "uuid": "79df4b52-c012-4aaf-af10-8e76b826d01e", "comment": "Malware payload (Mirai)", "value": "1d553f35fab05a92ab6c4fd3ca46892fe85afa92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799980, "uuid": "5185e4f3-32dc-41fa-9d61-a5e762ac82b2", "comment": "Malware payload (Mirai)", "value": "8e0ecda1bf7c547ddac8dd644ed4c779c34143b6b12a153cdb1fdbc10d2a69bdefb496dc19d99ec2b4066cccb0b2cb45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799980, "uuid": "150b1d03-0970-4965-bcef-b5f5b7879611", "value": "T15EC2E13270A183E4E67444F5EE3A9BC2135B03F9C1F6357A2650676440B718A2AB6BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799980, "uuid": "777d1fd2-7258-430b-8288-e2bff10d11ce", "value": "768:Ovn+3urNi9hDVx8EI5rVQH/Ays/nC74s3Uozdz:Ovn+erNi9lX8EID2IDvuzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764799980, "uuid": "83469551-172e-4767-b974-df7219ce5c9f", "value": 26772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764799980, "uuid": "de120e77-4e6c-44af-b246-cfe7cd9a2c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799980, "uuid": "7612275f-e271-48fb-9fa9-0fdbb2efa9db", "value": "zerobotv9.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb986164-d08d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764796787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796787, "uuid": "9cbee40a-bd93-417c-b3d3-2e7e88c59510", "comment": "Malware payload", "value": "24d6d4dea31b01cb471e3cb0e84fc2b6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796787, "uuid": "5b734224-105a-49a7-b96e-133f1e158c52", "comment": "Malware payload", "value": "266ad1a339b2bd51fecd3ec127c58c6065dbbb07c77460cba551e053a7541688", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796787, "uuid": "dab22709-5624-4772-8f93-4401191593ac", "comment": "Malware payload", "value": "4a734983cdec93464893d1bb50868b54b30f9707", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796787, "uuid": "d1a16e5c-2da9-4fa2-ad8e-738ebb668b62", "comment": "Malware payload", "value": "153fb0e3a48168a59686ef99b09735373f4abffbdb6373fa4b9347975f454ac64d39f4ad81d2ceb598c31ccee5d0cc01", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796787, "uuid": "00042414-add4-4f0b-ba4f-a697772cb81b", "value": "T1B9D33C0B375510ACE6BB927CC6965A02F3767808035243CF17D191BA2F63AD8BD7EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796787, "uuid": "5f0ea6ef-3ef8-4d1e-84ee-c86a0ac2c449", "value": "ba21da3b2fca8098915aa14aaec0c671", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796787, "uuid": "81a9f06c-33c4-4c20-b54f-f322556ba9bb", "value": "3072:Z1cclk7aHvRkvGXXzHG0m3I0THvNKiR3yW:PccewvpG0m3IS3yW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764796787, "uuid": "63046946-c84c-4707-8783-9bd943fd4732", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764796787, "uuid": "622b8c66-6677-4cb5-ba1a-120e9a2bf8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796787, "uuid": "23be0eb0-f9b7-4ac6-9c96-05e33c48daa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affc71c4-d053-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764771830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771830, "uuid": "f2d576c7-791c-48da-b760-d196951a2f92", "comment": "Malware payload", "value": "c5681a3f5f23c37b40a663b6fa42a9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771830, "uuid": "de954634-f407-4486-8d28-b447f4399a15", "comment": "Malware payload", "value": "26ce2660a8012a25e829d70be8ef36b2b6aa0dc7d8d10a61aeb11f75c2f77a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771830, "uuid": "6e99269d-7951-4b29-857e-81bf621d57c8", "comment": "Malware payload", "value": "5426bf0710c3364f8584f79012a6306a03333eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771830, "uuid": "ae768a18-e3ab-4cde-aae6-a2d4c0cedfb2", "comment": "Malware payload", "value": "caf2eefba1e0e6cf3e0afdb967316682c6c3cb5216578240db5b8c1e135079c4c95c184d53cfd8e0db4ae3d2db7e9e9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771830, "uuid": "612b24f1-9025-47f0-beec-d9b1736627ab", "value": "T157187D13B3A704D5E8F7DA7496E65223A932BC062F3085DF324C47261F73AE05A76B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771830, "uuid": "fcc251c3-bcc6-44cb-95c9-13eec669a128", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771830, "uuid": "a9033abc-521a-431b-a4c1-d09fef709316", "value": "786432:9pNzhI+nsVt6mHaIvAN6v+s4pgPVlcmgF:9DNI+nsPcN6v+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764771830, "uuid": "18288616-80f1-4d82-af8d-1d418f55f048", "value": 92204544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764771830, "uuid": "9857f909-3d69-4471-b3ae-120fdedda5e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771830, "uuid": "1bfacd80-8f4c-4975-872b-f3e57b34283c", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db346259-d009-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764740119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740119, "uuid": "25b82467-2547-45cd-9d63-af8929a4996a", "comment": "Malware payload (Mirai)", "value": "5599ce3725c74c02728b6f3a124deb6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740119, "uuid": "e245c3ef-92d1-4f3d-b39c-5f1d567c8f23", "comment": "Malware payload (Mirai)", "value": "27977750572dae0acd20282b9d3c9cf29bb51c01c0bfec1a9a68cc52c69fdb40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740119, "uuid": "9cdfef27-adbf-44ae-a739-87e3a7548756", "comment": "Malware payload (Mirai)", "value": "d33e50d745c9fea1906a093b1c0152c0f0f191cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740119, "uuid": "db1311df-757e-42ef-9aa6-d5f5efdd4bca", "comment": "Malware payload (Mirai)", "value": "de6a251a3bc1e95d2d94f7ab2fe1cfdf9d407e0cd52915488ac25d57d9fe59c7159af46cd969993985a67e1b2ef8c693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740119, "uuid": "684d2a9d-8d32-4899-817e-75cb291b3dfb", "value": "T178B3C84D6F219FBDF7A8863047B34F21939833E62AE1D685D1ACDA015E7034E245FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740119, "uuid": "c099630e-0ac9-4fed-a229-f9f712df3e25", "value": "1536:UaiZeamui1JQWGnfKjUJ64Hmw2Hh5fICDUwrie3uQUeTlCRxL:ceamui+nfKj0HmpfIUUwrisuQ90xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764740119, "uuid": "a3658731-b193-404a-a9e7-c9847e920944", "value": 109928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764740119, "uuid": "87afd428-e8ae-4db0-8629-da31e9c8ffc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740119, "uuid": "a1f054f6-3c15-4ff5-b662-d0ae06f646a1", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919433c5-d0a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764805279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805279, "uuid": "9384660a-0b09-457e-84b2-676eb1cdda63", "comment": "Malware payload (Mirai)", "value": "ca4fda3f11c99f38768875e934ac2144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805279, "uuid": "6e853a0f-b2ca-4349-b439-abf4e525c338", "comment": "Malware payload (Mirai)", "value": "27b6861b9e9acd72c8fb87bdc721aea9a1cc549edd70cdbe6ec8446b49b0d5a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805279, "uuid": "8dbe9fdb-4121-4d83-9d73-bf1fdb4e21fb", "comment": "Malware payload (Mirai)", "value": "4a4a9ecc659be97aafd405bbd19eab606b7c5217", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805279, "uuid": "6643bd32-49a0-4662-a6b8-e82be0241a03", "comment": "Malware payload (Mirai)", "value": "eebf1da6c12b9681aecf463a9c11ee425bf85e1614460bfd9821f5f5d8246f56623805993b53a5c64c92df04afcd95d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805279, "uuid": "4acd509f-8909-4319-954f-55a6f256ca90", "value": "T1FD144B46EA404E13C4D71779B6AF024A333297A4D3DB33069D286FB43BC679E4E67A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805279, "uuid": "ae62bfa3-1a8a-49ab-a4eb-fa72cb6ffb4c", "value": "6144:E2jeX80a4HI/8+oYPHaem4TZBpr1vxHkKqRiM/9X1:E2jeX80a4WbPHaem4TZBp1W7r/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764805279, "uuid": "098a4ed8-beb8-46ad-b184-a687afb0aaf3", "value": 206214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764805279, "uuid": "5530592f-6e7c-4061-8e3b-9175dc54ade9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805279, "uuid": "10cc9c2e-2706-4aff-b321-84308afb46a9", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07779a5d-d004-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764737617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737617, "uuid": "d8b60e1f-70ea-4921-92a7-b97d520faa01", "comment": "Malware payload (AgentTesla)", "value": "8817826772c3fb01e35cea18c71ae48c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737617, "uuid": "b382f671-206f-4ee9-b152-e3516d1ba911", "comment": "Malware payload (AgentTesla)", "value": "2825250210dff00d49097aef5a15b69dd932784076dd757c9fa9116aca8b0ce6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737617, "uuid": "331e3335-68af-4e6c-818b-0d3cf22bdad4", "comment": "Malware payload (AgentTesla)", "value": "6b76b1279977c3e5712981352b7c5e83f8cfd1a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737617, "uuid": "980e65ef-d545-4821-b3ea-7b2239f4e344", "comment": "Malware payload (AgentTesla)", "value": "c2fda6a4cff6109f46a76c5abcd956816a9479b9c83bd4a45f7a5acc590913ece8c24a843352f701430201759caf4a1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737617, "uuid": "44732bd6-9aff-407e-a088-428429b635b8", "value": "T16204309067D07C982B8B1B7BB62FF9D1E87F08ED3484444BC616BD90716470AF9E1AB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737617, "uuid": "1ae31104-d31c-4e0f-8357-0d2e1defcdcf", "value": "3072:drRfwO0NHWQkM2pIK/H0F+/kcLQmHOtto4q0/fgjzgW5XaMSlZioo5GplRYAY0YN:t5XpX3Aiybby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737617, "uuid": "61b505b5-641c-4e5b-8afe-d685670d0cda", "value": 173643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737617, "uuid": "1b2702b9-2ea5-4fdb-aaf0-630345782b63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737617, "uuid": "21680473-5813-42c8-a453-deaa5ee08619", "value": "Invoice_Petromar Shipping_#8201B340 - Jan 2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ff4b8e-d033-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764757935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757935, "uuid": "3f6ce9e8-3189-4ef0-92b4-dd747e90b6ee", "comment": "Malware payload (Mirai)", "value": "60dec85dd266dd31e6e53139dbc2e0d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757935, "uuid": "fe05b054-243c-4c9a-b237-5b3250022e36", "comment": "Malware payload (Mirai)", "value": "28a1505dc003af20e145a06793f5d7399572388c31bc663e5dde68983e35d10e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757935, "uuid": "09116b10-40e7-4616-a8c4-e8ffcbeda1d1", "comment": "Malware payload (Mirai)", "value": "f5d486e61848b7cfcc0304b6f4bf90de9a8d3087", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757935, "uuid": "c986d27c-f2df-4e3c-ae2a-2649de8c4172", "comment": "Malware payload (Mirai)", "value": "a8c5d0a55873d7ef9b504dfa03745170f2780bed9a9e04ebb0ca63e8f920a3097726fe056794ab9b3b50e6adea6ae906", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757935, "uuid": "295d2709-9058-409c-bbe0-24f1c99ae66b", "value": "T10D5151CF15CE97F0DDB5A99171E948046CC2F697B4C3DE56E9E834A88C8ED8072D0E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757935, "uuid": "32efce74-744d-46b1-8d8f-f7519217c06b", "value": "12:q0F2ZkNPxpFKX0F2wkB7xpFKX0F2oiko4fxpFKX0F2RktxpFKX0F2QLkQ2hVDxp6:v7U1tUYzYh/7qeEgnVvaNay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764757935, "uuid": "6f168ef5-3569-4517-8637-b31ba2fad9be", "value": 2698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764757935, "uuid": "05b8e19b-e158-4fcf-bb4d-6804d80e688a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757935, "uuid": "7151c5f2-25fe-4547-92db-a098123ca5ea", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e732c9-cfff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735688, "uuid": "f54770fc-a500-4df0-bee1-55817d19f3f0", "comment": "Malware payload (Mirai)", "value": "93684eeb8b4a25285b0efaed22e727de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735688, "uuid": "f2d74245-4cc5-4fe0-8841-add6b6fea900", "comment": "Malware payload (Mirai)", "value": "2b2c63fa44e0de19ce1f2c01e2144c2cac3fb906feea182a455c38e9d09c0685", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735688, "uuid": "9099bc21-29b8-4177-8f8f-d9d49a9a9e8c", "comment": "Malware payload (Mirai)", "value": "db80f62d8fc8bf64bd561d00bec88722eae853b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735688, "uuid": "8d710b0b-07f6-4328-a93b-4378f2cf86e4", "comment": "Malware payload (Mirai)", "value": "1359ecce68b27a411717629a5b700f27053efeea45ff6b00f27f31411fa024c4300420d801940444f539e13b2f4db670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735688, "uuid": "05cf18b4-3008-4b43-bf6b-e59129c49405", "value": "T100D32B06B30C0947D2633EF43B3F27D193AFDA8121E4E640755FAA8A91B1E325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735688, "uuid": "a3a87d87-1a78-4872-b0b6-40cab5508520", "value": "1536:j3z9a3asIE/kvkxIKY+J6eOMyEm0L8TAy/60ZvAY8QMhphRv3Vxqc4gHJjG3:1a3T/kvkxdwrv0ITgzYP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735688, "uuid": "24c4c93d-1fae-49c7-a472-44a4594d2520", "value": 133840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735688, "uuid": "3be20874-2711-4803-8c8d-b6dabb7e3673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735688, "uuid": "43239475-2dbe-474a-b261-c200b6f3310f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd1c932-d061-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764777918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764777918, "uuid": "bf7da5cc-2795-4ad9-8efb-1386df973e8b", "comment": "Malware payload (Vidar)", "value": "e9be94914a3baad07f0dfc5116756570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764777918, "uuid": "4bd5bcfb-d226-47a2-81f5-72aa9e0152bf", "comment": "Malware payload (Vidar)", "value": "2b671627a98c335af15443e21271262131f7b431d4a43448dbe099d0e685fda1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764777918, "uuid": "e4672968-ac30-4d45-88d4-392921af774f", "comment": "Malware payload (Vidar)", "value": "bf9f963a9da11674b8762708547392cd3da106bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764777918, "uuid": "1f77f984-ec9e-4e28-bd05-a84961c4ad9b", "comment": "Malware payload (Vidar)", "value": "578374fb0df95cb4272f9ffe2ade982ba8bee34074207b82a7ec19d9e9c30391c3989ebb7252ac99a8a09ca6d489caeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764777918, "uuid": "d247b794-2f9a-4e43-bb45-fa0bff5caf4f", "value": "T19E762841B8815465C469F138ADB6A261B7713C1943327BE35FE75AB60CFEBC42A3DB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764777918, "uuid": "83910826-40af-4258-bbbe-cd892bc993ac", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764777918, "uuid": "6d24386a-7f6f-45bb-b4c0-25ceb94a5b69", "value": "49152:0G9IAHo3Do4Gnya0C+tjhsFVVmc/RNP9FTttnMXpjPrK1sz73yLgV60XZq/wWgqn:TI3uLoVjFCLeZXZq4DE3RP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764777918, "uuid": "8101d581-5dd8-48ba-95e0-941e597cf23a", "value": 7143128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764777918, "uuid": "7de3f331-3490-408e-9140-ba38e3b64a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764777918, "uuid": "1ee10db3-340a-4bca-a135-d13220b04f6f", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab62974f-d087-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764794156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794156, "uuid": "a2c3f54b-d2b6-4ce7-8338-8b37f4dac8fd", "comment": "Malware payload", "value": "0737864c8e719e339506ba669ed887fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794156, "uuid": "c1dbdcb1-cc7b-42a1-ad24-38ae657ec298", "comment": "Malware payload", "value": "2be88438c5e6dbcafeba685234c76e639d6809c834782cc065820f6ed27d207e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794156, "uuid": "7723e58c-053a-48e7-baaf-b7e04f5a5dcf", "comment": "Malware payload", "value": "8317fcb5b08cac289d6d9267c5b8d77414a262db", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794156, "uuid": "889521e3-e7cb-4062-badd-7d65e9a9df90", "comment": "Malware payload", "value": "7f3de850f32dd55df0bed00862c9cb629b8814a763f187c62b56b9c9f1d68196217c9ed68db5f2b049fa4e3e85a36f54", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794156, "uuid": "113e1b04-77c0-42c4-babe-08eb4366f44c", "value": "T16841E8FD12812B3A30564A25A3E359AC9C468FD1B24A275CD5997C2B8C0F71C7BF9D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794156, "uuid": "206d4935-fa2f-482b-8c87-478c204513dc", "value": "48:pIUd8skaknhKapwMZBSZhVARA7AF3OHUENxB:pJuNnMaGuBQhKWJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764794156, "uuid": "0e87bc3d-e328-4077-82fb-ed335ad8dd0c", "value": 1883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764794156, "uuid": "10dff44d-1135-4d16-8079-5661d0e489fc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794156, "uuid": "bbc2df7e-69ad-4b25-9240-acfc8c2b0271", "value": "sure.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3496561-d071-11f0-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1764784720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784720, "uuid": "3c045380-f915-4fba-b9cd-c62b8003c29e", "comment": "Malware payload (XoriumStealer)", "value": "df6d2463377062d7a687f382ffef2088", "object_relation": "md5", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784720, "uuid": "f4e1741b-4742-4a45-ad23-ced7ea7fda73", "comment": "Malware payload (XoriumStealer)", "value": "2cbdf96c80d1e9167282ecb6f5f1033d4b747c5417ef5849d91b7a6104f99870", "object_relation": "sha256", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784720, "uuid": "e14f36ac-5b90-44ce-971b-a1cbcdfa913b", "comment": "Malware payload (XoriumStealer)", "value": "3db8810da14f8e6bf2e2b4a8b301c2c1822a92a3", "object_relation": "sha1", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784720, "uuid": "07a977cb-6d2b-430e-a305-c45ee13cd474", "comment": "Malware payload (XoriumStealer)", "value": "1653e1962c469c03ae7f281f5324ebcf9a32223ac38eb5cdb502d09174b2e7cd0476a7da829f2fc3c305fb5c91ead458", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784720, "uuid": "f9b5d49e-cc16-4cea-9f9c-0739327f33cc", "value": "T17025F01433FC2601E6BF8FB5E9B160448BB5FD1AE95AD74D1D8520ED1A72B81EA10733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784720, "uuid": "a82eaae4-3c32-403a-9e67-ceba3ec0b322", "value": "24576:9adBexcfYzPY/aYfsg/ZCDD6OyJxRoCNLsVqpnsBvyP7l:9adB8cAzPUsKZgD6OqxOC5LRsBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784720, "uuid": "5f72df5a-07b1-48db-ac36-053530970cbb", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784720, "uuid": "b1934fd7-ba3a-4e1f-9521-12ed8e17739e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784720, "uuid": "f9f9619a-5506-4d94-bff2-7cbb59f39863", "value": "2cbdf96c80d1e9167282ecb6f5f1033d4b747c5417ef5849d91b7a6104f99870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d5f84b-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764746823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746823, "uuid": "35a59513-67e9-47a7-bd9e-1fa4b99ebff6", "comment": "Malware payload (Gafgyt)", "value": "7872847e6d485c8fe6e2b42d4d49c22c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746823, "uuid": "0c33b430-8eb6-477e-a5dc-98383e33e86e", "comment": "Malware payload (Gafgyt)", "value": "2cec0b417608931a403cfe5b028bb36d7308fce48c7b6ebf6dd6b5e5ea4fda0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746823, "uuid": "45db2175-2263-467f-98b3-1c6aa4142837", "comment": "Malware payload (Gafgyt)", "value": "a6c766c5b18eb2fa3e93aca6ca5366660654f148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746823, "uuid": "0407da19-7c85-4d0d-8a67-4de993f8bd6e", "comment": "Malware payload (Gafgyt)", "value": "6a3a835bc9c77ac73b7bb4265c3852134fa26630fe79b997a79bf915a241f2619930522e489f25ed3c118555418d3e24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746823, "uuid": "235bc832-e237-4544-8c6c-2e9047167c8a", "value": "T1B813F198F35A5EE1CC716C33E97E538CA6B8743991B929B4200040F85AF304E5CFEDA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746823, "uuid": "2a41d9e7-f689-4696-bea7-7e7fbc4f9f45", "value": "768:lMdv9mUVFdIbtFcDqu3+FXe1PI1QN3H/cF2uvZ8rwTDJ/fX3Uz:lMN9TVFipqgde1ACN3HkLvewT9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746823, "uuid": "bb3f8a30-f04a-4f0f-9576-60c2acabe3a9", "value": 44344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746823, "uuid": "473d245f-680c-4061-b33f-c337522b8d0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746823, "uuid": "27587b57-3f6f-4cfb-a8ed-63859aa06eb2", "value": "Yboats.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c932f03-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736578, "uuid": "aedf3d0c-cdb0-4d00-bcd5-7b7336b2e3aa", "comment": "Malware payload (Mirai)", "value": "fe93987260cda04d4d697a89285489a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736578, "uuid": "067c5d63-7a91-443f-8717-3068cacbb064", "comment": "Malware payload (Mirai)", "value": "2d32b13fa3f24ef81aa57117c6ed39a56fa6623ce56ab78dbd0c80ff32aab814", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736578, "uuid": "ad320014-90f1-4f19-b65a-009bde2c78fb", "comment": "Malware payload (Mirai)", "value": "b87a93e342da996a0da90363dd735837692518ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736578, "uuid": "653e7df4-7b89-421e-9158-537f150ee7bb", "comment": "Malware payload (Mirai)", "value": "eb6410099b2169b5435122e35a6a260b5c255797347c2746475ba5569c0a16e29c5e612e7f6b096ba3f12604fe33708a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736578, "uuid": "92d4d908-dffa-4448-9fa2-6e93ed23d525", "value": "T1E754B6BA77107FAAC368C23805F343E996F3235116A39505E12DCA2C1E6538C5EDFEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736578, "uuid": "8235b03c-7cda-415a-ac69-e192b76fa43e", "value": "6144:5tELRUYfHvveKWQ2pEQXfjGONbhuBrgaJX1MFybW1:5tELTpMjR1cX2ybW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736578, "uuid": "fffc4e57-cd9b-42e6-ad8a-8526231df243", "value": 291300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736578, "uuid": "9ceb53d2-f981-4475-9e41-be84bcdff131", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736578, "uuid": "b88d76f4-6b56-43b3-9c0b-ad6745c79d48", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3e5287-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746941, "uuid": "4df8672b-fe16-4c34-874e-bfd78052da8a", "comment": "Malware payload (Mirai)", "value": "5912a2cca11d4aad7350dc2d9c216411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746941, "uuid": "82ac89f8-c250-417a-9271-26b591e57e2e", "comment": "Malware payload (Mirai)", "value": "2d7aad4cd9f534449106df11d19e3aed6a65db961acdd232885aee5cde939131", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746941, "uuid": "025a63cd-eab7-4846-bf83-7ccf9d277061", "comment": "Malware payload (Mirai)", "value": "7ba305bfd44d8a48136b12601cb79fac46134627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746941, "uuid": "912df522-078a-41e8-b0cd-cf5979f83cf3", "comment": "Malware payload (Mirai)", "value": "0d2065718b503a313181d1d0a805a87305a1d31fe56be35a072efbf044d6619be3acc00c2d4b4bfb2293d60004859dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746941, "uuid": "cbdc1f33-f378-4a72-84fd-999329191004", "value": "T1A013F1A0C3F955D9C4A9C13714EF3F095209730DCE4209F0AA5977FD288AB706E29BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746941, "uuid": "6f84f0f8-2b63-439d-906c-7d9bf46c7abb", "value": "768:6ryy1i4WU+3HDWPlgz2E4W/b7BuffXBmaXzOJmv81r3tauu0p+NlnbcuyD7UVyq+:6Z10lqP3EtUnBmaF81rsN0inouy8sq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746941, "uuid": "b5223dc5-bc4f-4f5d-8558-3eb6848768b9", "value": 43424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746941, "uuid": "f24086f1-79bf-4933-ad92-0b4431e53694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746941, "uuid": "0b56f215-f117-46e7-a4de-9eab11ec6f5f", "value": "Yboats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c98cc89-d099-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764801781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801781, "uuid": "3dda13c3-672d-4d8c-9ed1-2c41a16f45ca", "comment": "Malware payload (Mirai)", "value": "930f506aa1dbff53e46ea33f4735d4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801781, "uuid": "d89ccde7-ac02-4a94-a021-457077f32149", "comment": "Malware payload (Mirai)", "value": "2df09bfb9a61837bdc68cd2c895e4802deb2148198d76e4b5988bc90c01980c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801781, "uuid": "ba0af598-5fb5-4ef6-a1dd-eac105fe2c1d", "comment": "Malware payload (Mirai)", "value": "7dff366fdf7d399f3548ae8b1eaa6c687a735567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801781, "uuid": "31bf94c0-6574-4886-8b7a-5b6fce909985", "comment": "Malware payload (Mirai)", "value": "f115b941f9854f9d7c2d06dbff0d052ef35381938337d4a60530c488014797e4f7ca48820ccfdfadab15b9c62c75d99a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801781, "uuid": "2dadea98-c2cc-4168-ae8f-81dda5df7630", "value": "T1F8F35A02F1C194FDC8EAC2744FAFA626E936B45D1138B61B2BC45E262F4EF206B1D354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801781, "uuid": "8ddf47f2-ac0b-48c5-adc4-f4998b290324", "value": "3072:c250Hjz5p1NJIbuH93KBJWytt7feafr4rdv+gS951rLW:Lojzf1ijjfKx2LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764801781, "uuid": "84567116-1b46-4659-8c6f-dab05a8fae95", "value": 168112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764801781, "uuid": "0d481a9b-2c68-4160-8076-d6c1c996abae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801781, "uuid": "92b16394-5277-459f-b425-c4305a30327d", "value": "sync.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5492dbbc-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736458, "uuid": "61e2d250-7fde-436f-bc19-cf740a0eb4e3", "comment": "Malware payload (Mirai)", "value": "8cb4d0dba1ebdc8416f03a539eb293a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736458, "uuid": "fe68868e-8be5-4d0e-ae35-9a918aff5874", "comment": "Malware payload (Mirai)", "value": "2e080934e3e10448f7edb9e6a75d3676bbcceb5ec9e66eb7ed22c46a39686395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736458, "uuid": "c81c253c-8847-4a61-88df-a6e14adda4ca", "comment": "Malware payload (Mirai)", "value": "860406a97df66fb774c383472a0bedaaf01e3120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736458, "uuid": "b547a059-6736-4c62-83c5-43b46ffdc489", "comment": "Malware payload (Mirai)", "value": "c763629982b8dd4d9daac270768685d0ab35cefa11e4a425e123d53f287608992707d5e84fe8c086df7855c0b12a96a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736458, "uuid": "99be2b04-4824-4203-a627-cbeda9503c86", "value": "T1F1F34B47EA808A13C4D61BB5BA9F424633239B54D3DB73069D18BFB43F86B9E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736458, "uuid": "75a52b00-4574-477e-9968-82dbabd59b6e", "value": "3072:E+fYeWHuWoQiYiPa9Ge57bQDH31IJ35UUPo4PUJNM/9OwL7w1j20:xfYDtiZPa9Ge57be31iQ4PUbM/9OwLyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736458, "uuid": "be854a04-de38-4766-ac85-88a630106698", "value": 171614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736458, "uuid": "8e93e42a-bdc3-4fb6-9392-d604b08398bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736458, "uuid": "c954fbd1-fef2-4945-8f00-777a10c2d0be", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727e2af3-d022-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764750681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750681, "uuid": "d471dad3-2d1b-4e52-a351-6b33a5ffc763", "comment": "Malware payload (RemcosRAT)", "value": "cbca17f362f2c30d7c44c6450c3e055c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750681, "uuid": "706ce6b5-9b32-426c-821c-9464b053cf28", "comment": "Malware payload (RemcosRAT)", "value": "2efece12a2ddc0c550ad7606a0a965582e5bb2ac88bf01fab84ecd45c0c77d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750681, "uuid": "820281f5-04e6-4b8b-b965-e5fe823d7eb6", "comment": "Malware payload (RemcosRAT)", "value": "db84bde9beacc4549a909707a84c74b17d269211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750681, "uuid": "071b89ca-2667-44af-903d-1759b3aa981c", "comment": "Malware payload (RemcosRAT)", "value": "f41837444ae7dc0789626c5e92d081072c00fea542e6edb43923af3bff1827b80e9b6f5ec48a85b8b1b60227fa67ead0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750681, "uuid": "17f7284f-65ce-4b93-9aca-e90f64149388", "value": "T1D8741201B314C037D581073109B1E63BDEBEEABD12625E170B552B2DBEA6392DD5F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750681, "uuid": "3cf2c93e-a176-4ae7-a058-2732b40fcbdc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750681, "uuid": "070e1a12-83bb-463a-8ddd-e6eea6d8a014", "value": "6144:ObE/HUS18DBzawXXgXUNhoT3G8S2203sqFNApMDnKIUUmy0:ObY8DBGwnKSkWF03JF+2GUmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750681, "uuid": "ab8606f1-2f70-4c9d-9978-f018a4582950", "value": 356648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750681, "uuid": "dea275a2-db3e-4448-a640-4124ac505c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750681, "uuid": "024e0865-f758-4084-aa09-abb258c489cc", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7894835e-d07c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764789346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789346, "uuid": "3e889a46-f49a-43b3-9279-8e4e4d968926", "comment": "Malware payload (RemcosRAT)", "value": "e499caf060f71a2a1eafd7df6e9f1448", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789346, "uuid": "3017eef4-ccbd-4119-b700-045d2e1e33f5", "comment": "Malware payload (RemcosRAT)", "value": "2f715504efe6c079f1e70cb26b8946ca4fe5e2f6e52a521cb3a358a2903bde65", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789346, "uuid": "e39d6dda-374c-439b-b2f8-99f0fe5b1d46", "comment": "Malware payload (RemcosRAT)", "value": "b589645b4aa07c98edfc227006cbfb109172bb39", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789346, "uuid": "9a007176-227c-478f-a8e6-9b5a2e1e3902", "comment": "Malware payload (RemcosRAT)", "value": "87f921de4d85d12b51816823feaa122b07fdf3492906f717955b392c2452708ed9ce015dd0b189b078ac4a065ac33887", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789346, "uuid": "dde13018-7e15-452c-a27b-4d54bf28d5d9", "value": "T173562306011C01D98367F4400A3C1F87A71C6D6BE76F85583CF832DEBF6DAA469B9A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789346, "uuid": "98e058cc-a200-4df8-950a-70eea99ec6bc", "value": "384:0qAFunKHAMgGxdWBj/RP9xX9uNfGTw6qZowmk5k4pTok4k9TTTg0jQV8:lrnKH3gGxdWB99xYkMZTmsadijQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789346, "uuid": "9165f2fa-1815-444e-b2f6-0b48e56deebe", "value": 6388921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789346, "uuid": "f3e679f8-72da-4505-88e9-d04e4ca84fb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789346, "uuid": "cfb75e28-580a-4816-adf4-6c82f4f5c405", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1528192-d02a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764754276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754276, "uuid": "ef412da9-3f0d-4a00-99e7-1c985e5f699f", "comment": "Malware payload (Formbook)", "value": "31a80ba09894b7d12d9f08c9206e80cc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754276, "uuid": "674dd2f5-75e1-4e81-8ac9-678b268c2e2b", "comment": "Malware payload (Formbook)", "value": "2f925a339343eda660d85181448e1f3f94a3f34ad09e7379094d0e5a0bd16bd9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754276, "uuid": "0641e78f-d635-4a34-9e51-27315b8da35d", "comment": "Malware payload (Formbook)", "value": "0f4c4601c2419ba0c881c7e5d92e4ab9464a1b11", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754276, "uuid": "623af28f-a7d2-4f66-9e1a-dae641ca521e", "comment": "Malware payload (Formbook)", "value": "52a12ca8a97f32d42c45974ae76eecbef71d9391ec63168aa3ef932bc79e78dda791fe3710c9b13ce7faf58805c861c7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754276, "uuid": "d69cc582-0f63-4002-8094-3d4cb1653f93", "value": "T136A5B15D84B1ACD2A054FEB4F685FFD78CDB5385162B07420FE4859A3312C83FAA72A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754276, "uuid": "4fefedd6-5c82-441a-bff7-7a23204cfd30", "value": "12288:iVpEuQw6HEI4IdU+2ID0vyM/U/0e7uwDJ2Fl3iZP3GzDv44iXbA/b/UW1CU8JYeU:Ip/Q9HDVr2Xs0a31KlUPGQ4ioC/JhKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764754276, "uuid": "7e00ca35-970d-4a09-99a0-ec53d63b9282", "value": 2112464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764754276, "uuid": "f35b1de7-f924-4ac1-a2ed-326ff4e3beaa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754276, "uuid": "3146a779-517f-4ad1-a01e-db0304a7ed21", "value": "rSampleSpecifications.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f130113f-d042-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764764638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764638, "uuid": "b45dbfe4-a001-4098-bbed-8c5ab26bdbf5", "comment": "Malware payload (Vidar)", "value": "77a4c5f86909e518397f8a0bdc93c525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764638, "uuid": "99a5ed18-4d50-4ee7-8bc3-0f277e3b195b", "comment": "Malware payload (Vidar)", "value": "2fb685a1a7167faa83eef674cc9f00d21f0bd35f55ed41d7ee76eea5ecb57db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764638, "uuid": "e42bba00-8e02-497e-97a1-639dbeed4b84", "comment": "Malware payload (Vidar)", "value": "ede15fa494400b05192050100456e9cb24b34dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764638, "uuid": "822846b9-338d-4eb7-b19d-81ce1e78c99f", "comment": "Malware payload (Vidar)", "value": "89e7ea5c1ca09b920798e96b9698f4adf54e1a9e7c79bfaf8a9bcb3635203da58b4af105c4928798c5b216b6daf29654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764638, "uuid": "40be8f5d-231e-4832-ad5e-fd625bbe25dd", "value": "T1A3363817BD60C969D0FAE034B876618A767D7CCD5B30E7C72EA22A712EB63C05876710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764638, "uuid": "d6e0a05a-a452-4b5c-bd4c-c2eac03a3b29", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764638, "uuid": "dd0cff97-0e73-4da7-acff-0eef11b1bb17", "value": "49152:xUo5kQU0+dccVk2wx8SCrxi4UZJInwoVpqjpMG5AE2X39YiDcFQdofeP:x9SL8YwoAV5AE2XC4o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764638, "uuid": "48cce635-2ffe-425e-a344-c5c7dc804aeb", "value": 5137624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764638, "uuid": "da98c7a3-bea2-4e29-a071-7c1c4718f8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764638, "uuid": "5a243f17-353a-47c9-91db-7fa7749ef999", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1de242-d08b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764795768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795768, "uuid": "1081fe73-a1eb-4a4f-9bf0-ecdeee021b47", "comment": "Malware payload (Mirai)", "value": "02e1627c18bd1dde2e6fee73eca47af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795768, "uuid": "7838d581-c1c3-4258-a0fa-8e15d418273a", "comment": "Malware payload (Mirai)", "value": "3045c50367ddae17f62dbbb70dfa641a5e240b70c9bfe0795cfb2714c94ffafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795768, "uuid": "222bdac0-685f-4382-a281-df85f17a9d49", "comment": "Malware payload (Mirai)", "value": "2db3ab35929f910af25ae15d1f5eb0360a43485a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795768, "uuid": "ea38ea63-8689-4d9a-a13a-bbd158b058d9", "comment": "Malware payload (Mirai)", "value": "fd118e6b524dc534e2b7dace3d01380d528bc4d3b5d8e9236d89f1e1895fb6996357f8d2434320e5a604ee382990d92f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795768, "uuid": "92af4224-3c72-4fda-a12d-466c17d7a0e8", "value": "T16313F159D048861FE54C017226BEF9D01DF49F8E629CCDB64DC872BAD4383B57A5C2A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795768, "uuid": "9c093555-dfe0-4cb7-876f-77ae96f0441a", "value": "768:mT0BSWSk8Q7KeDQ0pb6f7wTb4E80ZcenizDV1A4lO1nbcuyD7UHQRjB:mTSSWSk8CpRpQ4UE80ZatW4Mnouy8HyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764795768, "uuid": "c6fcb2f5-86ad-4cbc-aac9-33ab1fb35615", "value": 43536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764795768, "uuid": "f391ad20-04e2-465b-bf3a-e37db4fc4662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795768, "uuid": "cc5f20cd-8083-4eeb-989a-f22dc76a5a4c", "value": "x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7107245f-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767429, "uuid": "e85e85db-755b-41c7-84ca-b6ecdceaec1b", "comment": "Malware payload (Mirai)", "value": "b259a4e39543e1d3649239d984366198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767429, "uuid": "9682d847-d08a-403d-b23d-e075183592d1", "comment": "Malware payload (Mirai)", "value": "30f6fd64db0d718c2724e3b187231dd03d5a4b006bc0b3f47d6a8c4debe44d49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767429, "uuid": "73efdf6e-baa3-4a7a-a922-4aa3c2d6233c", "comment": "Malware payload (Mirai)", "value": "bfbb476baeb2dab9d5eb60efbf0b4e7f0fe1fc3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767429, "uuid": "7acae665-7f6f-40e7-8dfe-d3ab25c6c8fd", "comment": "Malware payload (Mirai)", "value": "9e659df3789d45387c47d088aca5a644e073cc8750c52a9eb49a5f6fb1f258adac43e21e8285208faa224c055b38b28c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767429, "uuid": "30899189-f84d-4f4c-86a7-ffd74b74a393", "value": "T1B6730995B8818B22C9D512BEFA1E118E3313177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767429, "uuid": "5100cd15-28bb-48e8-9e69-ad5f8d83d8e6", "value": "1536:TAnYSDACyTQAbE80RbavEwpDQQMgiR33ATHa387oL5oYMd:mMCHUp0Rbavg3ATHa38kLyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767429, "uuid": "c216372f-6aca-4bed-9af7-6ee582fa58e9", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767429, "uuid": "cba49c08-fb08-4ea5-bf19-83f70e172b87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767429, "uuid": "2df16510-fb5c-42f4-b013-97dfd6bc2041", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ed4618-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764782179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782179, "uuid": "88a11a2f-4627-4652-a0e9-ec6b349834e0", "comment": "Malware payload", "value": "5398c00be8eb2fac52cab472b25513aa", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782179, "uuid": "e3d15a10-bf59-4bbc-9dc1-708b67aa7f8e", "comment": "Malware payload", "value": "31e598329b51d2b0caaf1c78f09c2dc986f66509a1e4c5302391bcff5deaff1e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782179, "uuid": "c11f8c1c-2786-4aa9-b9e7-6d81a0f109e4", "comment": "Malware payload", "value": "21e71f48cfa756747939483c6b6c3cf1211d401f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782179, "uuid": "cd9cbd78-be98-4031-b14f-678dc3fac866", "comment": "Malware payload", "value": "4c83881d3a65eed3d81b1ee19dc7b96f60021cd3c7a982c8ecbf3bc48f91376f84b69758f8a9be4bea5b6dc669e937db", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782179, "uuid": "c37755ec-3ca2-45c6-bb35-7c1d7f009cf2", "value": "T1FEE61243F758AB1BC477823369E60A3516160E078A43A797391C7B5D7BB7AF00E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782179, "uuid": "c83c0457-f298-4725-b282-5d578d1ccc0e", "value": "196608:wS5iqPyZCtanf5gFAzA3qHEfSQBcjHiV/mCnn5Ynnnw8hrb33jvQPYFZqrYe2EK/:wS53rt+k1cj8/mO8hrbEPRr/2xpKutKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764782179, "uuid": "de109a52-7b21-4b66-a738-e103a96846a0", "value": 14782720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764782179, "uuid": "5412404a-854b-47f3-adfb-4e529e41652c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782179, "uuid": "496f82c9-b508-4bfd-8092-3fd8037f61d1", "value": "sara365.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d3e0e8-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746868, "uuid": "937721b5-67f9-40b3-a600-1234750a7a72", "comment": "Malware payload (Mirai)", "value": "b9c2f3120393f34cef296d31fae22472", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746868, "uuid": "7cb5c164-3606-4524-b4c8-7201423a40ad", "comment": "Malware payload (Mirai)", "value": "3217056a47b76cb9d5b9ce1368c38c1994f1d6f07205961cf1faa2dbe479fddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746868, "uuid": "13dcf3c8-7003-4413-bb3e-4e0c89556182", "comment": "Malware payload (Mirai)", "value": "8f776bc8044d16d58f788f8b92a6d42b7ca07eac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746868, "uuid": "fc9f9f1e-3d55-43cd-a6d5-60a6e6e6847e", "comment": "Malware payload (Mirai)", "value": "01a652d94a0b04ba4a29519524984a443a1f358365810627f58e51cde52504cb5e0f7c30d675e3846ddd10d29def65a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746868, "uuid": "85054ed2-c239-45f9-bc67-ccf08f4e58ce", "value": "T1FEC33C46BD918A22CAD522BBFB2E118C332613ECD2EB71039D245B6837CA55F1E37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746868, "uuid": "b911b03a-182a-4428-9ab2-4303b19738f1", "value": "3072:G3+uA1ZrDx4kWn2J0frGcpDkciTT8HGqg6elFzy:F1hvJY3nK6e7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746868, "uuid": "1a5bae08-1376-406f-b3bc-2d174d974471", "value": 128600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746868, "uuid": "07092645-f594-4842-bf4d-be80c85fe57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746868, "uuid": "923ba15c-1a23-48f4-9f10-d4541769303f", "value": "Yboats.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741695e7-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746818, "uuid": "4e4af53b-722b-410a-91a1-8455fc209686", "comment": "Malware payload (Mirai)", "value": "40902ee7cd91887db4c0c8143769dbd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746818, "uuid": "e26e697b-023e-417a-89f2-52480a020a74", "comment": "Malware payload (Mirai)", "value": "32315ee27ad49dc1519356e0b107fbd7db8269cbf6f283648056d6459160af5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746818, "uuid": "7164c08d-0f3f-435a-9fe2-ac1a528ea770", "comment": "Malware payload (Mirai)", "value": "035b3ca4150b495e3c290fd94858969d3af66e61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746818, "uuid": "ad7bda1d-9d74-498f-bdd1-4b6f5a696914", "comment": "Malware payload (Mirai)", "value": "0829071a911f5236456002401f4510d2abebe8a9751ef18373c0cb5647f233cf29f586c747198993a4bf262403fe83b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746818, "uuid": "9863617c-cf60-4eee-a983-e9cf7ffd1b0e", "value": "T1CD13F1E0E0DE4CD1E0B27B70E24067E55BB8CDB5E9B878A321D94190F0A35175638FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746818, "uuid": "6e852a58-0a8a-4719-97cd-b30cf916ca25", "value": "768:Krpz9uQ9dSLrejiO0hqHKf/EKcdg75gkc6jvIOSkEFxrw64uVcqgw0RTWXf:WXCre2OHIVCkjyko4u+qgw01WXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746818, "uuid": "2cfb2843-b565-4ab0-9a7f-d2aaf65cef57", "value": 43376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746818, "uuid": "25fb9d74-f960-49de-830b-075581942cd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746818, "uuid": "58d3d377-be9b-4c53-b4a6-d02e49ee2ced", "value": "Yboats.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8e2803-d014-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764744766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744766, "uuid": "af759977-516e-4f4a-becd-498663764dd5", "comment": "Malware payload (Mirai)", "value": "c893554f905afdf8348f6ca88fd98e2e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744766, "uuid": "279a4b1f-d159-4792-9d2f-f04a8d3eba58", "comment": "Malware payload (Mirai)", "value": "32d5fe27db7b7cced757e91fc8401bf629969899bfff8cd384465cfee46b9b4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744766, "uuid": "93498372-7084-41e5-a275-2a98a6dbea8f", "comment": "Malware payload (Mirai)", "value": "382b83da715be92b755f5578b3df3ac82ef94b90", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744766, "uuid": "0ab94318-bb2b-4d37-9b4a-b4049cc3d5c5", "comment": "Malware payload (Mirai)", "value": "12713dea35f9be4a716fefd04768ee0902c9413c7b48f3aed75737af8cdc91b71051bdf68cee09544505c1648b2fd97a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744766, "uuid": "cb457630-73be-40b1-959f-3694dfb420bb", "value": "T15F5163CF15CAD7F1DDB559D171E948046CD2F69BB4C3DE42EAE824A84C8ED8071D0E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744766, "uuid": "ab56957b-5b77-4646-ab08-9f0ae31ae509", "value": "12:q0F2ZkNPZFKX0F2wkB7ZFKX0F2oiko4fZFKX0F2RktZFKX0F2QLkQ2hVDZFKX0Fk:vlULtUQtYhB7qy0o5VxGNGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764744766, "uuid": "aa913b44-ff6c-4849-b2e7-f1194393a96e", "value": 2711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764744766, "uuid": "083f91ae-1448-4f6c-9261-ea603ee19e4b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744766, "uuid": "9006129d-c3c7-48cd-814a-deb10e01be8b", "value": "pulse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a9e275-d000-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736245, "uuid": "a6b68a5f-10e9-4e90-a4f8-3b5a662d7264", "comment": "Malware payload (Mirai)", "value": "7bec06fe60521a5f1a7b5d26df418673", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736245, "uuid": "a84bfe98-cc7b-439d-a7f0-35e96f384f5d", "comment": "Malware payload (Mirai)", "value": "32f10ade26958d51d7d9cac50ff4a157ceb4476790acc13b34a1250969fdfc3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736245, "uuid": "42b5e359-3cec-4e54-b9d0-6ad2d9239b99", "comment": "Malware payload (Mirai)", "value": "d7f8da45e368c1ad380e1f2837dd21dac699a9bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736245, "uuid": "c1afc9b3-553a-4534-96f8-49db03a59f44", "comment": "Malware payload (Mirai)", "value": "683db0906ca35d64794ce4382932242eadb4f30994fd3391bb82685b3d9efad86701be25962d10ebd388f7323d8b76bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736245, "uuid": "fc1c2fa6-a133-42a5-94f4-9495bbf54e77", "value": "T13F7302B54760067EE80C003B7259B3A99854DE22420786FFF281789F6DF2BAE767C751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736245, "uuid": "00de9406-bc02-4442-a187-cdf5a3571416", "value": "1536:nDoL7NqOqcKZnftzZ5hS1b2qV/SGwWEi5FJ8UbPy4yYAzkN/bRSpBCW8Nnouy8tt:nDzOqcCdZ5hSQ8/fwri5tbPMYAaopo9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736245, "uuid": "a6577e9a-ef8f-4dca-937f-2b6694775347", "value": 77152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736245, "uuid": "eb181bb1-1b64-473f-b8f2-397ba11dbce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736245, "uuid": "393d662d-c121-45f9-bee1-dab497825766", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de6839d-d08b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764795797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795797, "uuid": "d1adcd03-bc20-4b8d-8e69-af6a1f1a6d4d", "comment": "Malware payload (Mirai)", "value": "55bea6365bbe309791901c0aa9dcb93e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795797, "uuid": "9c5c1b1a-fddb-410b-9756-c64bacf998f0", "comment": "Malware payload (Mirai)", "value": "33ab09abb7d68b99565b95d47d9b288fc829361811fa821806f0650f02ff9d18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795797, "uuid": "b42c4b21-c2c9-4a0e-9f44-9e545ac4f132", "comment": "Malware payload (Mirai)", "value": "a37a98357f788d5778a63b6e6f3b0e490ba1836e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795797, "uuid": "56ef02cd-6618-43f9-a6da-e1610e3b0369", "comment": "Malware payload (Mirai)", "value": "261167997125cf74fbae6efd4e6393c78ca19deba55ea04549aad46bf334a13557db2dab374971b8e858a486b992fd79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795797, "uuid": "ba629a7e-5e71-4abc-a4af-8e8e7be461d6", "value": "T10B837DD5FB43D4F0E45204B16077FB379A32E2BA1228EA43DBA5D932EC12542E21779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795797, "uuid": "8f89555f-14e7-45e6-b4ed-0bfa28104ee8", "value": "1536:wRvqjI3/DPuX8nUxfYm55QMv6MR1hdKXt4dQQdZ+x0LWFf8s3Sg7pP6MCwQTqsdy:WvmI3rPuX8nKgmPQMCW1hp+uif8s3Ser", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764795797, "uuid": "790b7009-27cc-4efd-9353-e16cc464a1b4", "value": 84048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764795797, "uuid": "b4dafbd4-d34a-466f-a39a-ca224cb4946d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795797, "uuid": "df4a3def-d1ed-4e99-8e98-13ded86b7ff6", "value": "x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e0b875-d078-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764787803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787803, "uuid": "f7432ee8-e722-4d75-97d5-dbacd671cbbc", "comment": "Malware payload (ACRStealer)", "value": "e5e7d9ddca1a529db1d76ceec96af674", "object_relation": "md5", "Tag": [ { "name": "185-242-245-31", "colour": "#30A245", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787803, "uuid": "c90fbd8f-89f6-4b83-999f-b9adba5031cf", "comment": "Malware payload (ACRStealer)", "value": "34126d2af7207d31cee9fab5b0426508adc683b3077bc83356dfc89c6f832d65", "object_relation": "sha256", "Tag": [ { "name": "185-242-245-31", "colour": "#30A245", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787803, "uuid": "bd5b40e1-8ed6-4786-91a5-dc5ef7608484", "comment": "Malware payload (ACRStealer)", "value": "fbcd4fd42503819500fcde7092657b04864e3a0d", "object_relation": "sha1", "Tag": [ { "name": "185-242-245-31", "colour": "#30A245", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787803, "uuid": "6fa1c248-169c-4e92-abdb-03035b5e6f78", "comment": "Malware payload (ACRStealer)", "value": "9352ddb1a3afa7a31f95c1a5f2db0ea4f65f823e6409c890a232563143fe90d46744ab9da1cc8d4a3a03bfeee9ece111", "object_relation": "sha3-384", "Tag": [ { "name": "185-242-245-31", "colour": "#30A245", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787803, "uuid": "6bc35f60-6b8f-4415-b2aa-80c806b662bd", "value": "T1DC178D3A31AA01EDD1F7D1798A46D913E6717C15036186DF0AE03A6A2F7BAE08F3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787803, "uuid": "70967f6f-20d5-4d90-bd6c-0a8f9bc7a594", "value": "c7f5f247336d114c939449f792d2a4eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787803, "uuid": "bf7b4846-cea0-487c-af8e-12dc3fc678b7", "value": "196608:Sf1vmcGUmnkSS2sYkULaayJEzhxAmuADk/812X1tYu90T:SokN2sayJEzhZtDX24u9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764787803, "uuid": "0b67d764-96b7-4e3f-992b-f12f90b49b3e", "value": 18753728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764787803, "uuid": "3e2acfa0-38f9-4da7-9365-5c03e97c03b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787803, "uuid": "741b4eb4-4884-4b50-b4ce-2020fe41ae40", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2872ab6d-d00f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764742397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742397, "uuid": "1a5fb604-23b5-44e1-839d-257ae8a6fb3c", "comment": "Malware payload (Mirai)", "value": "dfe8dde39d95e00fdbb49f9bbaaa9594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742397, "uuid": "a56f3ed0-ea26-4721-bbf4-b7b8ec5a0235", "comment": "Malware payload (Mirai)", "value": "3447bc685864f31a77e484dd715b64dde33d2bbe604327b2b9cbf15630282109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742397, "uuid": "eedb3fd4-2b99-4b06-b643-40444ef778cc", "comment": "Malware payload (Mirai)", "value": "2a89e6e3e33cf221b50b0d6a20382bb692a9907e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742397, "uuid": "c68a8ef9-318f-45a3-9e53-da13e627e4a8", "comment": "Malware payload (Mirai)", "value": "6a1cacd0b70af6c18ae0a1b035f94eae402a091f44449603ff12b7ce46ebda722e18af40cf4577eca946eacf79cc5808", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742397, "uuid": "e64d63ac-86c9-4ba7-b965-fe30cc667915", "value": "T112B35BE5E643E4F9DC2651356276FB379E72E1BE1318DA83D3F89A326C12581C406E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742397, "uuid": "dbb077c9-0660-4b16-8094-9e74020410ce", "value": "1536:yO/f9Bza8WUJiANiVadaHpL4JRuN+lLhbfvtAVgA168GpumzPYB/:fBUaiANiVaMHpIR+ibdASL/pumzPYB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764742397, "uuid": "6a190c7f-3d17-49f9-aae5-3468d0bc1e35", "value": 108016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764742397, "uuid": "3e3c9800-5869-4ccd-8934-fb21e2abe696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742397, "uuid": "aec8fe72-6066-4c96-85f6-1d97811c95e7", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68a3a2f-d079-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764788269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788269, "uuid": "acf0b8b0-ec5b-4e68-b1d2-7f431ffaa41a", "comment": "Malware payload", "value": "bd047eebbec963535221fe3b981e17fb", "object_relation": "md5", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788269, "uuid": "158cef60-f223-4eb7-b89a-39915d9965a3", "comment": "Malware payload", "value": "3484785bf32cfa63fe9f33d43f44be8324b29b07b73ab2da7f554515bdddc2c2", "object_relation": "sha256", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788269, "uuid": "56e71710-fdd1-4311-a3e5-3230cd4fe34b", "comment": "Malware payload", "value": "c36a4095c69c07de1024359d2e4f1b8b097cb143", "object_relation": "sha1", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788269, "uuid": "0caa11fc-3d83-4b84-a40a-32e11f949c53", "comment": "Malware payload", "value": "db06d6a6ac4515692a47c0efdda0a6ea965ccd8aa30966bb214e85a5847521ff772ac13e97db3831afa6e7cb55ce5001", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788269, "uuid": "b1917109-154f-41bd-adb0-31525d5a6133", "value": "T166734D9988CB90E8672738A889DF9D06F7E5D453211DE9D1FB4CA9F02F1143C91F89E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788269, "uuid": "dab715e7-d634-4a20-8f00-919b2cda06ec", "value": "768:GvNmiekkkCL7qEH5V4TCklpihsPjxb57XSC7KDvL6aHAtbgYxzDPfwp1X5HYaXjK:LDVsptbgfMzgxYv5mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788269, "uuid": "121fd9e1-5a0b-4041-a2d3-a3e0dec61474", "value": 76938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788269, "uuid": "e78d8b96-cb5e-4219-9891-2b36c605ee22", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788269, "uuid": "ae6c6fd6-1845-4c34-853f-5dc7043a1499", "value": "silenceSide.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3683ce5-cfec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764727705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727705, "uuid": "83d9088f-c71a-4369-ab3f-1928b56cd269", "comment": "Malware payload (Mirai)", "value": "b4783142ed1a22ab0dc2ae2184298dad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727705, "uuid": "2ff26eaa-ecde-4645-b978-0060ed48d48a", "comment": "Malware payload (Mirai)", "value": "34cadbcd9f106fc3683d38f645e98c815f37753564261ab10891cfa040f6aa5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727705, "uuid": "6bc9cbbc-d737-457d-a01c-ee885220a34f", "comment": "Malware payload (Mirai)", "value": "1b88096153055a1235c38e3f3f97543fde998bbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727705, "uuid": "ce10c0d1-8f26-4771-80c6-ab54eb7ebde1", "comment": "Malware payload (Mirai)", "value": "641f6be04d4284b08535c04b9eede1f99b3a7555576d360ddf142bfc8becfbde83cf9ff571f9ccf5970a1643c3a3cda3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727705, "uuid": "c2285675-6b64-484f-a6a5-55808d5e9274", "value": "T1A183085AF9C19A02C9C105BBBA2E555E330B67B8E3DF3313DD141B24779A62F0F2650A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727705, "uuid": "63f39601-9bfd-491f-954d-98a4157f8ae1", "value": "1536:0Xnae+als/1cGSPFMUgQFazpnhrczNTnSiMriZaSsPLiB7Et:jai/1PSNMUgQFaznCaSsPLiB7Et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727705, "uuid": "0a9b58d2-8df5-45c3-9e04-460f495c6e98", "value": 83776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727705, "uuid": "a2caf1d2-1b3a-4dce-8206-948346376d60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727705, "uuid": "0df639fd-4fc3-44ea-8fb0-8750f9580930", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12608c6a-d092-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764798624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798624, "uuid": "d92310f8-8b17-49b3-979f-29bc349256cb", "comment": "Malware payload", "value": "3542c0026ead1af4a6b08d9bbc47c6dd", "object_relation": "md5", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798624, "uuid": "273fc24b-8b25-4a7a-8817-43e791e131cd", "comment": "Malware payload", "value": "3564dc15ab3605e687602ad7dd894203e6b4438126d0f7d99e2d7ee07884a7d6", "object_relation": "sha256", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798624, "uuid": "0c290506-0774-4591-bb9f-92a06f7ef8b4", "comment": "Malware payload", "value": "a095b633388f6c67a4528c7fca4fbaca3da9472f", "object_relation": "sha1", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798624, "uuid": "3ee6b5ed-f9c3-4a2b-926a-06b557a2694d", "comment": "Malware payload", "value": "8206393b5dfa62eda41e0e719776ab791e5c816e87fe1cec6c741ad75c3dfae440d4a814f9f0980db49ae019f57f7856", "object_relation": "sha3-384", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798624, "uuid": "ba4eac23-ddd4-46da-b2c4-536c03b517f5", "value": "T1E8F18D2B3B748017F356853C29EDE42AB59C8CCEA12E017233DF4A661AA0C5573532BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798624, "uuid": "7226c858-8d82-4610-942a-bdd643f4a75d", "value": "192:muKBuPdHB5pmCHyg7nftTLa1pgtUDM3p7C0WPUcz:mhBuPdHZ/TLa/gtURNPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798624, "uuid": "c4d8d457-85d3-45db-8495-1f0558eabe7a", "value": 7845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798624, "uuid": "0ae5808f-9216-4b58-a366-a4ab3cffb3f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798624, "uuid": "87c20e75-ba7d-42b4-be7f-a1fcac079743", "value": "Shriek-Bootstrapper-2.1.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72325870-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767431, "uuid": "b7579205-da69-44f7-9be4-b20e1b7f6e14", "comment": "Malware payload (Mirai)", "value": "80cbd81b316f67f242153fe7d997be26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767431, "uuid": "4d52920d-0675-4fde-b361-2d58ca791167", "comment": "Malware payload (Mirai)", "value": "372c102fcf8b57bc53c4caad84438da65e11ae59726c97b73dd2cb7669d5babe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767431, "uuid": "7298a06a-759e-41bb-9afb-a0067a60db41", "comment": "Malware payload (Mirai)", "value": "f255103907327f12f7d20bc3e60ee1349014e355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767431, "uuid": "35e831f4-5778-4bff-bc25-f64c43063377", "comment": "Malware payload (Mirai)", "value": "dcd4c2cc19a760a97a2b03a69a80d671290825befe8705b0050a3a600daa3cd017a73c9c7d92c92b0583cf3ca8b4cb04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767431, "uuid": "90394336-ad13-4ca3-ae0e-071209351ccb", "value": "T1F1437CC4AA83E4F5FC9701751033A73B5A72F4351069DA87C769D83BBC52A11EA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767431, "uuid": "e0e315ea-0d2d-4fa3-a286-3d8e4e4942dc", "value": "1536:ZyN5z8bAOpvnd02e98v2POtI7i5BDQ+JSz0RZ17+v2nzhNKSM:0N5wUOpvnReO2WtY+gz0r1K+nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767431, "uuid": "71cc5e42-5db6-4d08-ac4c-fd0ed3dd5ac8", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767431, "uuid": "27ff1e67-1577-4a44-8b1b-2c8d4b7b6003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767431, "uuid": "9605451a-1796-49c6-b7b9-d9b3600dd1d5", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ed9eb6-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764767655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767655, "uuid": "37f49fc5-937b-4bd9-a860-54128c67e376", "comment": "Malware payload (ACRStealer)", "value": "959391ea11b3285ac2b67f6169ed189c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767655, "uuid": "ebf167c5-ae03-49de-a5cd-8e659e489001", "comment": "Malware payload (ACRStealer)", "value": "37a351ea8df374c0be3ae20bd04f515cd6b0121db8c463c87dbe730d6abb08f4", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767655, "uuid": "6d664ac4-f5b3-4f13-8bed-ab0bb66afed6", "comment": "Malware payload (ACRStealer)", "value": "4f59c713b73746a50cb4651fc85ac951949a705b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767655, "uuid": "bb1eebbc-fedb-4770-82cb-c629864b88dd", "comment": "Malware payload (ACRStealer)", "value": "0cef2a49b0060fe4bff8f3dc0f1b6b17fecf7e092a2ae150b6d69cc51a4bf3273fc3acb4edc4ed412fa74b57d0b6c584", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767655, "uuid": "cbccbe86-0aa3-4c6f-ac51-0abd09013492", "value": "T1F18580E314551067DCA804BE2ABB7F48D8FEA53E9E64641B5D753CEC4C328F218A864F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767655, "uuid": "53f55712-dfc0-48ca-9c31-ce36f75b99ac", "value": "ae7cd1b9cde5396babfa7a3dddd5a850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767655, "uuid": "6017a182-af9d-48f0-89bc-7acd7e0059fd", "value": "6144:rD0tj54s9NqeE/9ojAFg2wjlMAByeFo64:rMj5JNqFIYRwRrYAo64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767655, "uuid": "45f045e9-7a8c-410b-bf30-5957708edef4", "value": 1825200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767655, "uuid": "fb71bbc7-d6d2-4c45-a1ba-c492943d54d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767655, "uuid": "9af93b27-d7f3-420f-b8d5-5eb2f7bba648", "value": "37a351ea8df374c0be3ae20bd04f515cd6b0121db8c463c87dbe730d6abb08f4.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb5513f-d016-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764745627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745627, "uuid": "14777139-1fa7-477b-83a8-933db26d2534", "comment": "Malware payload (RemcosRAT)", "value": "0bc082e861182bc08ae781be3cdf4a57", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745627, "uuid": "f2d9945d-732f-4bb1-a67d-49f19b20f416", "comment": "Malware payload (RemcosRAT)", "value": "37fa5a4fd4cc772735a96fef23037e24c503ff7857858c80e68ff28d5c77ad79", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745627, "uuid": "67f4f6e5-a99c-4a6b-8635-8ee72fdb7f31", "comment": "Malware payload (RemcosRAT)", "value": "159ab7dac188e8b812250690a7f7c3c1b0da0c31", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745627, "uuid": "82d6b6d1-ce44-400b-b9ad-01bc2d4485eb", "comment": "Malware payload (RemcosRAT)", "value": "7c33ad183c7a9ef82048e503a8ff0a44426f928b2c1c644cac15c074d54c1788889c242b4d9af1d233dc1dbed855e0ea", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745627, "uuid": "9c2a7e1b-c363-48ad-8241-09b3875f3121", "value": "T151164F1BBE6BB70AD99704313C3531818B3D215ADB4E6F44B1E84D068FC8647FA99ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745627, "uuid": "371dfe45-5320-4176-92ad-f67ccc3420dc", "value": "768:4wwwwRwwwwwwxwRwwwwRwRwwwwRwwwwwwxwRwwwwRwwwwwwxwRwwwwRwwwwwwxwd:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745627, "uuid": "a1dec41a-78e3-44ac-aaf8-3d5ee1d69dcb", "value": 4353102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745627, "uuid": "c268a5a6-a94f-47b3-975a-a72e29d07cca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745627, "uuid": "b7c41f62-58e0-4e15-9777-68a8059112ee", "value": "37fa5a4fd4cc772735a96fef23037e24c503ff7857858c80e68ff28d5c77ad79.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7360ce64-d045-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764765715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765715, "uuid": "4a91cd58-7f75-4b01-8c61-edd97a034385", "comment": "Malware payload (SalatStealer)", "value": "75d7cd3ed543182421aefa70a4e895b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765715, "uuid": "173c935a-028c-4bc1-9bfb-58f94140f75b", "comment": "Malware payload (SalatStealer)", "value": "3845ad8b92bf909843c14f50367c81c5583fc8bce481faa95eb6ffb2cfed59f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765715, "uuid": "c6bf7d45-927b-4bb0-b417-7f589a94271d", "comment": "Malware payload (SalatStealer)", "value": "2b2136ffa149d668364a10788ce5b299452537bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765715, "uuid": "f5cce017-8dc3-4172-aa36-db1aecd6c828", "comment": "Malware payload (SalatStealer)", "value": "e87bf6baf7182c9f80b4a335d8be3bc1cbba7aa35cce660af415d70bf88b925c65cdd666653de8c7092cb56ccac74543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765715, "uuid": "124c11e5-19f5-4bc7-8557-a56cd5709365", "value": "T1E716225480C0FD57D3712E309459FB0D8561BFB0EEE8479221B9366EAABBBAD804C753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765715, "uuid": "655d4ecd-4f26-44a0-8ff9-649dac87542b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765715, "uuid": "795da50e-b2b0-4e96-8596-8675056686ae", "value": "98304:P8OGlZva6vQze6kVgDfUtPAjHkpT37JJLaDVpio+PNm76jq0cvg9:0OGlU6NgDfTHktrJNaDVpio+PNm+0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764765715, "uuid": "df71b42e-9096-416c-b29b-e9023d7a3ac7", "value": 4396544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764765715, "uuid": "b1defd20-d06b-4bd4-95db-de961e90f3ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765715, "uuid": "41968c7d-9ec5-40d8-9444-fd7c01aed511", "value": "Solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fc3a11-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749591, "uuid": "37b3ca8a-6ac6-4c1a-927a-40e01866c06a", "comment": "Malware payload", "value": "d50837ac4d14b50613ac91b63e8e8fe2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749591, "uuid": "8ed76e76-a818-40da-984d-03fdbb0dcf5c", "comment": "Malware payload", "value": "3a4dadb297beb324ae1aacb95df8796bda783ae28c6a8910139bd1180958e97c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749591, "uuid": "2ffb8977-2325-4898-8c1b-3c325fb56e87", "comment": "Malware payload", "value": "c855b6afea02a8915db2cd0c90f68931e5041d68", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749591, "uuid": "85105283-4868-42a9-ac55-77f7ef0fbf6c", "comment": "Malware payload", "value": "06b0b19f361e90eeab64fadfcf8ec9e4852c5ab8e39ae5505ae340400dfd3e4bb8147e5d20959ab0ad72307c95301117", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749591, "uuid": "a336a2b0-1d4a-4c1e-919b-490c82793fde", "value": "T16E673363D34DF81BE1B7A17282F306577A7141D0B605F6667A18E1BCAEB7E40DB04AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749591, "uuid": "c0a71d5e-6b37-439b-9555-5cb5538b51a7", "value": "786432:auzWq3Ifx5zWq3IfDAXv/9eHAW7EINLMVcWpiIyhjwEtg5rakTm+Iqm:aqn3e1n3EAXN+A1IdMVqIpgghO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749591, "uuid": "02833619-4235-47d2-a2bc-5f7cc5162016", "value": 30339445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749591, "uuid": "6efe8214-b8ac-4e4d-8e9d-cb47d21563ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749591, "uuid": "e952e115-4c4d-4578-bc23-41d9f2a843c6", "value": "unitv_4.8.4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afb9909-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749461, "uuid": "d156389f-9fbf-48fa-8afe-a6c63170d09a", "comment": "Malware payload", "value": "7374b7cdaf87346796a8728e9020dfd2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749461, "uuid": "cffa20ea-e29c-444b-81bb-5609c140e06e", "comment": "Malware payload", "value": "3aea0345c88f069d3a079c82571086adafb585137a86e277f4e5c9fb1b2190e6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749461, "uuid": "b10b987e-e966-49fe-9ddd-d522c01433e3", "comment": "Malware payload", "value": "1fd9c680512f07dae21cd828f1d003905d72466b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749461, "uuid": "2b78e0a6-9d23-4ef4-8055-08d078b66659", "comment": "Malware payload", "value": "58e323af860c82e58771575d0ebe05aeb24e6d0b29122cd415724abb72cba5588ab54b6aa1f503ae6d74a31902f1fc53", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749461, "uuid": "080a0643-9bd2-43e7-ac3e-1d8935ae2fd1", "value": "T1DD560255F708A42FC5B761338EB6533162468D8989C2EB136A28761C6D73EC48F5EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749461, "uuid": "ca353b8a-ace7-45c9-b107-8a67eac741bd", "value": "98304:X8p4zoSoQKFtBlUHd3l71YDCpr7A6UnQ4h36u5g9tGu9tG5NAhoZQ9TMfbreRn:switBlUHdbpfA6UnHz5gDhDEmhckMmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749461, "uuid": "66802837-4220-4788-80f2-c96e9144c4ae", "value": 5967526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749461, "uuid": "19c984b7-424f-49a5-89be-dc50a877ca40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749461, "uuid": "11a64af2-93f0-4dbc-829c-494a71b9bffc", "value": "246caipiao-android.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f977bd-d0a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806166, "uuid": "1988d359-8bc6-4a07-a7a3-30c50da011e4", "comment": "Malware payload (Mirai)", "value": "2ce867a1478488036563500c3e27b207", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806166, "uuid": "da52daa0-8cc0-4996-afb1-17de9c479952", "comment": "Malware payload (Mirai)", "value": "3bd64f85ca4ab7de19efae6a160bb24c1553182efa8aca8de17c7704ebaf5117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806166, "uuid": "65e8dc97-9aa5-4a30-a280-b8fa05244eef", "comment": "Malware payload (Mirai)", "value": "770b295911a2d81eb4541df7c5db92289c7fb947", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806166, "uuid": "8261742c-4bb2-4b80-ab0e-56a42a865c6b", "comment": "Malware payload (Mirai)", "value": "bf16e5f884284af0d571dccb0bcff50fc9d24a0b28f35465f605e05495bca71e720a5696e2ffbcd33f8489578c948486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806166, "uuid": "aaed49e3-31e2-47d5-b9cf-f88b68585ebb", "value": "T153A36C22B5781927C4E8987713F34322F2F6578E14B88B1E7D720EDEBF245902A475B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806166, "uuid": "ab6b6e0f-2391-4290-a109-e51f73fb1824", "value": "1536:2CZEwXe1mlLqcOaTeTn78ohAIOa31HcZFXri6wQwXt6QWjl+5gEMYlAd1tph7Iu:jMcFgJHIXraVUhlmgxbrh8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806166, "uuid": "122439f9-af96-48f4-8fa5-d42251542814", "value": 104984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806166, "uuid": "c39efeb8-7a95-490f-b261-d2c107fde4f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806166, "uuid": "1912f311-ea74-4083-989f-6f4e685e1dbb", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a340946d-d0a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806168, "uuid": "7654336a-83d0-417c-8626-4a94c347c2fc", "comment": "Malware payload (Mirai)", "value": "1e2f84f1aa10c24f7f75d11b355f1697", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806168, "uuid": "27e0d403-dcda-4147-96fc-7c2b08ff57fc", "comment": "Malware payload (Mirai)", "value": "3c0fe8965f74cb53b12f5a7d06bf881361d70c3e8a3df10a9815fc1cc5457264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806168, "uuid": "e1906119-ece7-4390-8cd2-f5a978aca102", "comment": "Malware payload (Mirai)", "value": "66056e650d5b147e817937b8901e6add7d31e398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806168, "uuid": "d8cda091-240d-4a9c-9528-9d93a0e796c0", "comment": "Malware payload (Mirai)", "value": "44ec7d1fcb1ff5e73904f69a7da18f3c768dc96bdc4bf61a145234958cc6efac945222a68c30c9612e60086475a6216f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806168, "uuid": "8cc67429-4b8c-4484-b6b8-faacd33592bd", "value": "T1CF23E1D3333EA7B7DDC5D0B70E687C8175FE08A38D3647A9129968BECA51A051642FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806168, "uuid": "0bf0b17f-bb71-46ab-80ce-ba051b08fea5", "value": "768:fVtYiwdU9i6ma9pH4+fqWQQPYcx5swIGUCQdj2qQXQInywKahXRLPQMntdx0WIR:fVtociyN4+Cnu1swmQXNnywKaB1flw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806168, "uuid": "68b87cb8-0d1c-4a80-ad00-5b58beab458a", "value": 47460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806168, "uuid": "5162da1f-510b-4f58-8a57-eef7b09df2c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806168, "uuid": "f47bc690-ebca-482a-a229-6cbda74f965c", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c8a8cc-d00d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764741726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741726, "uuid": "f1356d01-9a76-4c9c-b12d-814014e07b67", "comment": "Malware payload (Mirai)", "value": "a340ddcd3293cf6c8d541218034d1f20", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741726, "uuid": "396247d5-011e-4499-a80d-748bfef94421", "comment": "Malware payload (Mirai)", "value": "3d5888d6738eb360dd349c2638c737b7c79c345cde859b4eec89641a976a52b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741726, "uuid": "9f8eac21-7f4b-415c-91f9-d1ed8a3d4c6e", "comment": "Malware payload (Mirai)", "value": "df833d07b0fb392e3accd8861cbbacb99f8e9240", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741726, "uuid": "ae38cf81-9adb-4fc5-8a36-5288636f3b0e", "comment": "Malware payload (Mirai)", "value": "a9b453d4b8c779dcb6fcfcb87805d84c75d2a66571280e6ea64a059e929f66340b3b282932f7bf68779ed657f2ca0908", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741726, "uuid": "f8d59b31-d78f-4c3c-80dc-6ac031add29b", "value": "T1A63133C82162843638A59927B2FB8EA4F9E05D5169C89D585DDC3CF895CCE4CF870BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741726, "uuid": "3e54ee58-bf85-47d4-adbe-7ab6d8b5c54a", "value": "24:v/fr/QjQ2Cz/sKXj/l/rtT/qQ/yK/0E/k2/CtG/7V/8B7z:vLxESdBTBJh3x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764741726, "uuid": "b8e59fc6-82df-4b7f-903a-027b3684f80e", "value": 1810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764741726, "uuid": "c3124abb-f101-4dd5-9790-bdd0949a748c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741726, "uuid": "98078d4a-5fb7-4d30-a3d2-a4c7d38c4d17", "value": "fentbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a1805b-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793846, "uuid": "3095d728-e1cc-42c5-b234-af675ac3da05", "comment": "Malware payload (Mirai)", "value": "fde173cdb7861bc0a9308644c8c87ccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793846, "uuid": "ca3ffd5f-b6c9-45b0-83d6-04f9a1f00ef2", "comment": "Malware payload (Mirai)", "value": "3db7aedf56068337e9c82114acb0be5ee7d8f8ff79fdb26ee40c5c91fb6c813f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793846, "uuid": "bc33100e-9a62-4b3f-ab1d-03f42fcc440e", "comment": "Malware payload (Mirai)", "value": "ed25fdaf6aba0fa5200c6e0db2b7c8b719276720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793846, "uuid": "69b317b6-3017-4c8a-a2a6-daee7cdefe73", "comment": "Malware payload (Mirai)", "value": "2da0386c97ef44ec726b19917f1b74e13ebe5ea3c649d7db2b0a7df02313d28eeb49ebfa7766338130c6c8787778dfe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793846, "uuid": "ce827b1e-4ed2-41bd-bd47-22d4bac696d5", "value": "T17B933AC5FE8BC1F6C51788304066F33FDA31E96940718A5DEFAA9F35DA33581A21235A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793846, "uuid": "f3f77422-9c08-4353-8ed8-1e5d146c36a4", "value": "1536:v4Qn2LDGdKjIkR4GTMjelo82B/jkYevwWPQQ/T7r5h3KNj7VPd:AQn2HvjN+Gkelp+QYCIQ/T71h+Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793846, "uuid": "a9fcfee1-932b-40c7-ae1d-5e159419e2cf", "value": 91412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793846, "uuid": "6e9e851b-ebb4-41d6-ba5b-d309c4d085e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793846, "uuid": "0cf36911-5c10-4e35-9830-c85eab8594c4", "value": "zerobotv9.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77fdffa-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793854, "uuid": "19807e13-5099-486a-8a9b-58e0f7042d5a", "comment": "Malware payload (Mirai)", "value": "8d7c51bec81f106da2a90760ebd46e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793854, "uuid": "07cf9437-ba77-40bd-8de9-50fd3e00f065", "comment": "Malware payload (Mirai)", "value": "3e857c32d2ce8bd08f2d7eb30f35e954e48c7638f3dd4a21fb56807851dd023f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793854, "uuid": "8ae09670-941f-4687-a69e-3ffc388d13d6", "comment": "Malware payload (Mirai)", "value": "1c6cf44ca6f2bc2f8362f443a71ee2801ccc0b9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793854, "uuid": "569ace66-caaa-4628-864f-58049c64307b", "comment": "Malware payload (Mirai)", "value": "1b1bbcae3e285bc7d38ee604a3a9d35f2b9e5b60c756b297a49709ac0ed3f975e9e557ec044aa5f1b309c7f8c2b297ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793854, "uuid": "0c8ef7d2-676a-4ad8-8cdb-1f054cbb0fb4", "value": "T15DC3D74E6F319F7DFBE8823047B3AE259359239627E1C585D1ACD6011E6028E285FFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793854, "uuid": "664cf772-78c1-454d-99ca-39077a9d6bbb", "value": "3072:RUBKptXkVO+w7l35XUcLELYW2cniRpZD1u914:OBStXkVO+ql35XUcLEB2HnK914", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793854, "uuid": "c910ba12-673c-4c0f-a1f9-a33ef95a0496", "value": 121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793854, "uuid": "a913e793-f1b8-4513-bf42-f13640f4975c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793854, "uuid": "985d3e36-dc5e-4ea1-8a46-1c872686331d", "value": "zerobotv9.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac91a7ec-d087-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764794158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794158, "uuid": "42631665-43b2-40f6-8b88-44f56a3c09da", "comment": "Malware payload (Mirai)", "value": "9b2c9580c2ab6686c3cf4a58d465a1db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794158, "uuid": "606e8501-588e-4a5b-99bc-896d7e036ffb", "comment": "Malware payload (Mirai)", "value": "3ec7e43ea002611c3bd533fa123d2a2365ca151d1dab0a3863b2a368c39f18dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794158, "uuid": "85a8fbfb-bc03-4363-8eaf-88b09fc4fe8d", "comment": "Malware payload (Mirai)", "value": "39d8b8a4a6f645c7f26e9723bd47c98801c751f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794158, "uuid": "70a54837-cf21-4bba-a7f8-74824c9de4e2", "comment": "Malware payload (Mirai)", "value": "a4166a6e5382d3c8d7ec62194258c161997051ae6f6396740d7355996e4458adc33152270bbb9c14171efc1f6c1b496a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794158, "uuid": "9c430cb7-9edc-4cc3-8762-d0fdef8e7537", "value": "T149A33BD7F401CEBEF80BDB7B4457090AB931A3E106831B276757B963ED361961862F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794158, "uuid": "55a0004e-3c2f-41ea-9d53-5ecdb3276c7d", "value": "3072:CNsIIb8bhZARtRzy2BVyGaKKiuFs+3Tvxv:VrPy2PyGaKjuPTvxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764794158, "uuid": "d88b6d2f-fb3b-47b6-9229-4141bb27937d", "value": 100892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764794158, "uuid": "941d1712-8326-49c1-93f2-f8052e617908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794158, "uuid": "1b0817e6-6267-47bf-9c57-cfef15d331c6", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b69b14-d085-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764793156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793156, "uuid": "2910acf8-6b87-47b7-96f4-9665f9ec7525", "comment": "Malware payload", "value": "419b2c2d7736b04a647391dc14d1aa74", "object_relation": "md5", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "HavocC2", "colour": "#9340C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793156, "uuid": "01d39f51-de9f-4606-a844-1838b62d07cd", "comment": "Malware payload", "value": "4022133358853a9c42167dbd4493195146cb54f06a6e023b170ab1cccc5c00a1", "object_relation": "sha256", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "HavocC2", "colour": "#9340C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793156, "uuid": "801f76e9-1e08-4e44-b203-a45651eb42f3", "comment": "Malware payload", "value": "9edee2597ee32b46948e08e79fe6ab87d4e99e6c", "object_relation": "sha1", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "HavocC2", "colour": "#9340C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793156, "uuid": "77e484e5-4997-41d4-b09a-e4620c08405e", "comment": "Malware payload", "value": "4cf9c1f0481b61626f9b36c44c2fa8e4549b7a96f571da675f39c7cbece766768e694ff556a8e65bd025c198fabd7fc3", "object_relation": "sha3-384", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "HavocC2", "colour": "#9340C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793156, "uuid": "af59ef5b-bab0-46da-97f8-0772d621b358", "value": "T1DB84232675E56F0E47E1C61F18043D5BBD595DAE8B98A084344142B3372A8F36E3E3AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793156, "uuid": "03c2941e-270c-41a1-88f2-c74032ed72b1", "value": "6144:iSXiTjVV8RvkMQtWmuoN1N+lBOseIcbeB+gNEV43cAPX5y6VjjKLsFId3x8f1P:EjOgoCN+losvBB+gNEVgcCX0q9FIdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793156, "uuid": "5785e75b-7da6-483c-be21-62a1997bc7bd", "value": 391249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793156, "uuid": "6501aeb9-176e-43d2-9883-0e81b51e8891", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793156, "uuid": "3e4302af-9fe5-4d4c-b283-a415aaeb1c02", "value": "WinSoftwareUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ea6c08-d038-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764759995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764759995, "uuid": "32bbe25c-b2ac-4aee-adf5-6839e8e95cff", "comment": "Malware payload (Mirai)", "value": "1347cd8aac8c2c543865d2f1961ff0b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764759995, "uuid": "48db52b0-1c5a-4107-bb44-f82e46e0a432", "comment": "Malware payload (Mirai)", "value": "40340e3a77486c1369e0c0983e376950720970a61d9645ecccdc68e6a10337f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764759995, "uuid": "4042e412-f6f6-43f6-9beb-9d43e922e83d", "comment": "Malware payload (Mirai)", "value": "d895b894c335444a2bc02aab0ba1992322da4bdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764759995, "uuid": "ba7c4b9d-d088-4128-ada5-168223bb3f2e", "comment": "Malware payload (Mirai)", "value": "cffabca85af60eb79af2eb1caaae2d2c00ef5f6370cd2fdea60b7c5894b356aca5966344c304ed185e77813c2eb3e157", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764759995, "uuid": "35703644-a517-4be2-bc06-6470b34b7097", "value": "T1DFD3ADCBB34F1860C46206F40BC74B8D2E5322168E17C9E76E8E6A7A397D6DF19167C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764759995, "uuid": "9c8a5b61-b92f-4189-ab9c-d0d7854691ef", "value": "3072:cYZexlAWUCVQiDg00bGSokj4fvoxLgCnDq:lEOngSEHcbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764759995, "uuid": "a096c5b1-1646-4309-9fbd-5f8a8a007afe", "value": 132432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764759995, "uuid": "999e3307-b557-453c-8ef4-b088bd8fd2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764759995, "uuid": "64f6e42c-d4ea-4c65-ab34-d6ef5e5fc36a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc909f49-d01a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764747477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747477, "uuid": "0f156bce-b31f-4d63-8228-6ec62053f8c3", "comment": "Malware payload", "value": "0fed60850aa38127095f21182cc2c85d", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747477, "uuid": "ed781e16-20f3-42dc-b41f-8d951e4aabd2", "comment": "Malware payload", "value": "40a59422fa486c7ae214d6e816c2fd00bf4d75c081993a49c4bc22bb0165b7fe", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747477, "uuid": "6107cf55-91af-4662-b911-40989f646d7f", "comment": "Malware payload", "value": "09af2ff14c2d77fa3168b0ee95219bbb35d0ffd2", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747477, "uuid": "73b63c19-8c75-4207-b6e5-69e6f39012bf", "comment": "Malware payload", "value": "2da2f33ecf34ddde67045bd06e511a60f5a3b4940e0bf0a1b2f1e0e7a98ea193721e39e24f4f8f378594ff8f49e73d70", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747477, "uuid": "21692c07-eb83-4b83-93c8-68980dac1d56", "value": "T1515633CAF87758F7CAEE21344DBDD52072A960B7B321C55866C292BA41186F77F1E0C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747477, "uuid": "6895d812-d999-4808-ac93-1fda92fc7c3c", "value": "196608:ylOAjUX/pUNpusLDfoL8bk9hmpy+yFVqiDT:zAoXCpuqMLeMqin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747477, "uuid": "dac8b39b-e970-42f8-bcf0-631812e314f1", "value": 6346808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747477, "uuid": "57891a62-9d33-4b38-a524-fef8be390393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747477, "uuid": "ca29c709-9975-48bc-861f-0ecbc48a13b5", "value": "APT36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f3a58d-d011-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743572, "uuid": "7c5ae774-4887-41e1-9558-b58a1bc0a5cc", "comment": "Malware payload (Mirai)", "value": "d2f6085db43250e39ef790977ebd3df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743572, "uuid": "21072c7e-1d9e-4513-8856-ca0be161f109", "comment": "Malware payload (Mirai)", "value": "40a7368a3d66a369932568fb79d25b090cf8996e66a9337e6c2da2443529eb20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743572, "uuid": "1cd04951-b7ce-4281-b5c7-a217e0702841", "comment": "Malware payload (Mirai)", "value": "a87b6204733c2b9e92283788f86a7fbc12a38aab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743572, "uuid": "02e49ce7-fca2-43e1-9f84-6228b4c4d911", "comment": "Malware payload (Mirai)", "value": "fec80e0e36db8c7c665d4ddb4367eef54561b5b5ac73984c7d031a8340ab81e7cd0f6751112120e91ba67e1bfbc4b372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743572, "uuid": "6c126b2c-ce31-4777-b62d-7c4b76acfe65", "value": "T101D3F746F8819F11D5C151BAFE0E528E37131B7CE2DE72029D246B347B8B8BB0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743572, "uuid": "7656de04-e394-46cd-a1b9-8458a8d91ff2", "value": "3072:JEao9bD5rkBXgpKQpaaMSw/XTPvMeKD1ol4J:JEaYD5CXHQgakrvMD1omJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743572, "uuid": "91e771da-a8fb-409f-a8e5-1a114d5b1105", "value": 141980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743572, "uuid": "b953de3e-77e6-4472-a007-8d1ed11c6132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743572, "uuid": "fcc172a9-d681-48dc-8e94-affcae53385b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c91eb8-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767353, "uuid": "a0679996-7188-4c0e-93b0-ca196ba43bc3", "comment": "Malware payload (Mirai)", "value": "d36801168239130a8fce014b9a195c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767353, "uuid": "12678973-289f-4bb8-ae78-e4ec3473ce1e", "comment": "Malware payload (Mirai)", "value": "4167e6a09a19b01df138e36dd5caf2d30a071c38a084c0819f89fd9a41b20450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767353, "uuid": "652f0463-14a4-42b9-bd8a-bf0a0255e218", "comment": "Malware payload (Mirai)", "value": "6ea866f411539702faaa982d8cd003de87ea53a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767353, "uuid": "fdc682d8-99c2-45fb-991b-c9b736178feb", "comment": "Malware payload (Mirai)", "value": "b88a5ee685a41d941f4203394e2f7797d52accd6f5fe6ab4de31120f9e944d851ce7045bb3c88344aa5f0385a6d9827f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767353, "uuid": "6f118556-dea7-490f-ba80-f90cd9a0f344", "value": "T1FCF2F234072A03F6D55A8BB60F6B4BA03C9B0F31B5139A5A6F65FA53DB8353C38E5250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767353, "uuid": "37155408-808d-4303-9d88-4da009412cb3", "value": "768:tlWqYyhCV4X3D4nNkVEZbOwmGBUm/KnzNAdhxJgGlzDpbuR1JQy:2q+V84OOmqUmynRotVJuey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767353, "uuid": "c78f4980-110a-4b0e-9065-4f1bdf327e36", "value": 36120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767353, "uuid": "bb7d638c-21b7-497a-95e5-04b99ac262b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767353, "uuid": "4b0c4ce3-2ce7-4c2e-96fd-923d040aee62", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c8a3e6-d07e-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764790202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790202, "uuid": "b172bd5b-10f7-499a-8517-92b915357e41", "comment": "Malware payload (SnakeKeylogger)", "value": "136cc8ae8c25835c66741800b5c5764c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790202, "uuid": "b47fac49-6cce-4e62-b1f7-3163949d3188", "comment": "Malware payload (SnakeKeylogger)", "value": "424326823d5f4a84fd99c1ed64a5a173cbcd3bc6d196919714aa3c969b218fc1", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790202, "uuid": "f64f8afe-f4d1-4360-9054-4153e9655459", "comment": "Malware payload (SnakeKeylogger)", "value": "713ed987824ef3940cdfaf43ba9cd5fc566ab37e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790202, "uuid": "38eaf7b0-095f-4ca2-93b1-affc04eceeff", "comment": "Malware payload (SnakeKeylogger)", "value": "b74abb1ebe1bab65cfd34cb9a839691fca1f5699851c35a81de8938dc99d58ea97d4ca36521b6ac2290feac8447caefb", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790202, "uuid": "9cc978b3-1659-4e0d-8cc6-f12ce25cce5b", "value": "T18B65F2118DC46FB9CFAC961990FE161ED3E05A8B50167849FB3BBD4AAFF7604061B0D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790202, "uuid": "2c4fb052-5f7b-447c-91c9-4256a20e83df", "value": "24576:4xYBdpZidoLvQt9P9y7aSfgt+HAAtlSA9GpbGB:Dd0oLYt9sOSFHtlepGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790202, "uuid": "98cd23aa-9490-47c6-9b4d-2d812d222634", "value": 1439235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790202, "uuid": "862147ad-a697-489e-8e84-06be574ae683", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790202, "uuid": "a9c0287a-9f32-4dfa-a563-55d83205fa96", "value": "CSSIN2025948_DSC_INVALID RECEIVER ACCOUNT.pdf.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12e5098-d01c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764748263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748263, "uuid": "689ed8dc-81e0-4ca2-8503-565cfa9fbba7", "comment": "Malware payload (Mirai)", "value": "5c222ad1b026e0f07c3e5a17ba2ee5b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748263, "uuid": "c8a89c3b-47ce-422b-bfa5-46a6a1133028", "comment": "Malware payload (Mirai)", "value": "4308a7e3287f22ff23888562b5bebf5616ef2fcefc5e5bdb95c4b627a2f735d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748263, "uuid": "f7f33e81-a408-4682-9e47-2e17ed54e979", "comment": "Malware payload (Mirai)", "value": "90eeb6d9e3769e2915e621746c8688d0213186ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748263, "uuid": "0b828065-a34d-4504-8c7a-be9312ec82be", "comment": "Malware payload (Mirai)", "value": "ad2f15e47694fff8b58ea6db0b7fe90edf4c1d3bf2ce761ff4ea7dab695430f32aed3e9bbd66fc05299c66f7f95274e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748263, "uuid": "76dcb245-dea9-4404-b9df-ebd7e2e581f1", "value": "T1DEC33C8AB8019E7DF82BD9BA44274D0AB930979156C30F2B267BFD936C331A47D13D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748263, "uuid": "fd8cd2a2-ae10-4e27-bc83-d27908140e25", "value": "3072:m/waFQ+DTlb08DEUF7vwmaQRA4Fa8YVJo5i:AlDTlbLDZGqazVe5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764748263, "uuid": "12aca9d7-aa53-4157-acfb-f6518aec0c0a", "value": 120652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764748263, "uuid": "84061b67-cbc1-4c1f-ad46-fa668bb33776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748263, "uuid": "fe0f2caa-de58-4ede-bc21-e2126d6b9b9c", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fb3f01-cfed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764727863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727863, "uuid": "823b5932-fe99-4f59-aec4-e9fbc79f70c7", "comment": "Malware payload (Mirai)", "value": "5e2e2f3e69de2c326cca612ab83b1710", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727863, "uuid": "14071786-d88e-4558-99a5-bd3ba29fe158", "comment": "Malware payload (Mirai)", "value": "436a9cba56190286d8066d3995445a836e450a523069df240382d537d053258e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727863, "uuid": "732f9ded-2267-453f-af8e-9d9c103feeb1", "comment": "Malware payload (Mirai)", "value": "e288c24bb7cf279c4c22d7554ab75bbb10d5dde6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727863, "uuid": "3e4f0902-dfb5-4a1f-9ba6-f87dd17867f7", "comment": "Malware payload (Mirai)", "value": "41c2360bae3650ece9d59f2fd33ff3a8f6b7581fb7e274b22f0f37779c5a43f8808735972f990dbe419d9d237bfa4986", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727863, "uuid": "69932134-1b48-4585-89eb-591ccb26f83d", "value": "T1A531C4CA70E21D712CE4DDA771AA48167483E1CA58DA6F49B9DC38FD6ACCD08B014F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727863, "uuid": "987f74ff-1eb0-4ea8-a3c2-964eeb162362", "value": "24:kXCZG+1ZuZI4WueAIfAITVAI8AIEjAITAIRAIlXAIQAItKHAIKRV:e0b54NeNlV+mjJ7TXGDicz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727863, "uuid": "017404e6-ec20-46b7-adc3-b7fad900dfda", "value": 1633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727863, "uuid": "48797756-5e5a-4bc2-9abe-2a7ab98ffa99", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727863, "uuid": "c8702f10-7cc8-46e8-9b90-e6f7199d76bc", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510c32b6-d040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763510, "uuid": "5d34e25a-1d5e-4e8a-b803-e7407a31e60e", "comment": "Malware payload (Mirai)", "value": "852a4af175d315f04cf8fdc6a696c92e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763510, "uuid": "4d90cd30-91c9-49bd-8e7e-c9c5d35c64e5", "comment": "Malware payload (Mirai)", "value": "449e30caaa96c2833e4f381071095addc874ad4bab41e21225acf6356145c0ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763510, "uuid": "d49f4ab2-2586-41b0-8012-5cb3d290afdb", "comment": "Malware payload (Mirai)", "value": "6ecc20f59da028993d79fad2d9b80cb4cfdcb92b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763510, "uuid": "6f8ff718-e99c-42fa-96ec-128d6f0e66ec", "comment": "Malware payload (Mirai)", "value": "6afde169e3d5e64145003652d1ff1e9954af51679c5c0defcbaa4b87902bfba7d8ac6bf9f4ca41ae687537d239df4161", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763510, "uuid": "9d5316ba-c9ad-4d70-8bb7-79b9008ce020", "value": "T11F24648AAFA03FFFD85ECD334295CB0A119C490A12947FB66A74D518B78B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763510, "uuid": "8d5e1f35-0b6d-4870-ace2-7a4894601da2", "value": "1536:E+gBA8HaOcN9ka2q4BUVTEx5hBbY9Hxfgaw4LbDrpKkUWo8tsT5NRBFY1eF8ElqB:E+QZHaT9HRfgawqZ/SVBi1ePn5rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763510, "uuid": "58ca513e-5ee1-426f-b92d-87b52d22926b", "value": 223480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763510, "uuid": "eb82bc74-d539-44ef-8138-361cb5e7193a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763510, "uuid": "c2759cb5-3425-4814-bf74-f69a4212d3ce", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d14c072-d090-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764797836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797836, "uuid": "acf8bf8b-17b2-482f-b182-7dbe755ea68f", "comment": "Malware payload (Mirai)", "value": "5a68013ee2a360c57b594dbc617fa9d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797836, "uuid": "915c52ca-9160-4ee2-83ea-b6b7d50d0b4b", "comment": "Malware payload (Mirai)", "value": "459d50cf69e456edf4698c3fee7cadc36f983f78bc7e35eabe4aefcca33b34db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797836, "uuid": "03e52c4d-7770-4d25-8608-dea229a9479d", "comment": "Malware payload (Mirai)", "value": "58d5c615a4d3c4053c5a3132143ae001605249f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797836, "uuid": "2e51cc13-c609-4b44-b73f-f17148407462", "comment": "Malware payload (Mirai)", "value": "a2cf2a7fae55d18af29b631c3c2c8ce6cb2edca8c321d5677579ada173e2578ad957a34b78f0616d52fc4ff4dac48e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797836, "uuid": "d1a9dd8d-7561-472a-9c58-133d80716bdc", "value": "T1CA933892BC828A2AC6C113B9F66E26CD3361A3E1D2CF3217CD264B1277D520F0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797836, "uuid": "2a9af43a-41d5-4eba-a246-0518be2beee7", "value": "1536:JVxto8nD/wp/NBQ7iWRYYR4pnXlTPTWYlSB7GWhC8:JVxtosBclTi0SBqEC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764797836, "uuid": "1135c609-4db5-4e91-b7ce-4441052d94ee", "value": 92836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764797836, "uuid": "7b47390f-a5ab-4d9e-8cf9-5d20a2d39a3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797836, "uuid": "a682a2d1-b641-4b5c-8755-152fa2d22f34", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0407411-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749469, "uuid": "b01c346f-1867-4167-9cee-6d07c63b170e", "comment": "Malware payload", "value": "565fb0a79911b996142b73e0d4f17dee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749469, "uuid": "e908ed37-5f60-4fc4-84c3-a3052f996f93", "comment": "Malware payload", "value": "45f546ed00d0ed250e28f3fea009e219f252de5716ac0b32a123e295e5b5180d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749469, "uuid": "31264130-7364-496b-a01b-bbfb681d3e32", "comment": "Malware payload", "value": "0318ea4139d7e21df0ffe2f2ec2a5f42e6e0dda8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749469, "uuid": "470dadb8-3bd7-4e21-bcde-3b5292f90a48", "comment": "Malware payload", "value": "cf5022fb4ad7893e7cf1a761f00990766eba39f19f4144a43ca4a85d131a1b448c1c2b108b14392ed0ecdc9a2d157e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749469, "uuid": "0728fd57-b503-4080-996b-d75ba672423f", "value": "T13146BE05B3A81E5BE2BF9B769074563093B0FD03A321CB8F9646A5ED1D637C24E41B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749469, "uuid": "7a709ea7-cd53-4773-9a8d-e225226283b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749469, "uuid": "e8917f5e-9cd7-4e47-b53c-7e90a8473d44", "value": "98304:qLjJTClAleBmh35+z39BBCR39/7SAX9dz:qXJTCqleBmd5ODITT9dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749469, "uuid": "15b58640-925d-4ccf-8f7b-f66b5249e307", "value": 5760000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749469, "uuid": "dca2c40a-903d-4ccf-b71d-d58a14a3af67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749469, "uuid": "a494f871-8480-44cf-816c-f994100330f7", "value": "Plain Craft Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2250f0ed-d05c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764775457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775457, "uuid": "ad2d8491-a985-4401-bc95-927d6ae485a5", "comment": "Malware payload", "value": "fe5fd92359116d058714889506360dc3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775457, "uuid": "eece1475-d93e-4474-bd14-1b7325e96ba3", "comment": "Malware payload", "value": "4657c2f8e2cc23aefef83e9da4cb35b1a82bfcb17d1936dcf7dd7e2345239e65", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775457, "uuid": "5ca6cbd5-bbb2-4732-8e3a-52f17e20fced", "comment": "Malware payload", "value": "6559bb7f352a689de3e486d12d5c4e660d18c26f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775457, "uuid": "a04c8ad3-f0a8-4b96-8eb3-65a9eea81ff4", "comment": "Malware payload", "value": "df24498f819f2241f98d716bc9026113ade046030e601ee05f3ffb2f31f8c0440d328ae488ddf4c4e145b03fab74bef9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775457, "uuid": "de0eab61-4f76-44a3-aa40-abedba4865dd", "value": "T175C1646073C0788032CB8FDB672BB9D6FA0AAD513FF90C8ED550AE15EDA1180D6E05B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775457, "uuid": "daebd4b9-af3b-498d-9aa8-35e5540658aa", "value": "96:8G+YEOjoY+brkK/zxBrl5OuHBrIa+OMpW3+Q:T+YEOE1bT/zHRV8xfW3+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764775457, "uuid": "7ebc83c2-d6cf-4607-9af6-59fa4c1a8510", "value": 5914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764775457, "uuid": "081966a1-7aa3-488a-af1a-57c740e40d0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775457, "uuid": "d36d3823-4e45-4d4e-83b1-00fe3d840946", "value": "Cezac6o6tu7je5beq0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df41a761-d04d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764769332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769332, "uuid": "56663e1a-aad8-4932-bc7a-c637f3703863", "comment": "Malware payload", "value": "6b9bb7a9426da77e27b7d41ebba39f68", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769332, "uuid": "472d78ba-fe28-4e6f-bc96-936bbd6f1b40", "comment": "Malware payload", "value": "4680b7b5b54c2756a881bd03614f971a25e08afc86d98b7368cb161da931c4eb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769332, "uuid": "ebea2105-9531-449d-ac4e-06ab1938dcaf", "comment": "Malware payload", "value": "87d6cd29b87f875e1b1746f61a7d89cbfc426ac2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769332, "uuid": "144d8c42-1d4d-4204-95bc-4506a9102ab4", "comment": "Malware payload", "value": "520138ff70e2afdcf119a4b32fcc9c7b233243942385d9aeb20659a9e8e1ede2eb92a6e530397d3b5fbeb6de4027ccdc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769332, "uuid": "c9d465fe-5c7a-44d2-b7a6-160ab0cf3f7a", "value": "T16A5533BC23E42D1FF140D6F99A59B55CFE81266CEE8E078296E7E919241F2130382F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769332, "uuid": "efe26f71-d21b-43f5-ac18-4ed88400c5e8", "value": "24576:XhCxjXJ2DqAd7B/ZkeE3tHa440t7bv/S0paFq3eL/u8hAh5aglbyqRVQfcYsZvpN:XhUjcDtBKeE3w4PnBpaFY0ah5n+qsf+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769332, "uuid": "1d125722-beae-4d70-83cc-42460125c8eb", "value": 1350538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769332, "uuid": "3df72245-dcf3-4811-87e4-d6427ffa4f10", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769332, "uuid": "9e350eac-e862-4caa-9609-dc0ee46c2127", "value": "6f5e0a787ef15da08fe170df1b9b9dea90d481c09252251c9c10fb65f347fbc3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0dec39-d015-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764745032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745032, "uuid": "ead1c021-e5c9-4812-b9cc-e089de1a149a", "comment": "Malware payload (Mirai)", "value": "79aff85437fd065cc284046945499bbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745032, "uuid": "658b18fb-2f5c-4deb-8b6d-5b4d464b1696", "comment": "Malware payload (Mirai)", "value": "4689375fcf8ab2ab15c49ba0dca64b42a52f1a1a4b1218ec614c4add903a73e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745032, "uuid": "226e4adf-df4f-414c-a993-b1fa03b89779", "comment": "Malware payload (Mirai)", "value": "1de757ef45cf55ea48bfe0c975431c88357da0c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745032, "uuid": "1d7ff4bb-c37f-409c-b678-3531951eff45", "comment": "Malware payload (Mirai)", "value": "d4831bd661346c2e88470bb2b066dcc008c87d3cc4fc8fd3341d1eb762600f09b05e514292de5c4c871f217db7a04a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745032, "uuid": "31186698-c8df-4cf3-84de-c4a6d889cdee", "value": "T111B34B1173180F47C1931AB02E3E1BE597FAEAE021E4FA89255FD74A42B5E371489FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745032, "uuid": "b0ee88fb-f034-4864-99cd-9faba77ebe08", "value": "1536:6KU6Mp6LXH2L0hmBIn5SyCSqXTzsQevG4zGyrrhAVR7kPC6rY4szM1:M6aGuIn5SDTA7zzro7iCvnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745032, "uuid": "a6ed7d79-a535-4f7e-a7ce-59cdff5f58dc", "value": 116732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745032, "uuid": "0b45bd82-f736-4d4b-9d73-62284d9bd960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745032, "uuid": "4ad3f56b-a2b6-4bd1-b858-cfec753cd992", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf88e86a-d042-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764764554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764554, "uuid": "3e26c59e-f71f-4db5-9fa1-425ef27d8452", "comment": "Malware payload (Vidar)", "value": "8009d8d61187fa3b30e9d615ca5f5342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764554, "uuid": "1f4f13e6-da5d-44d8-80fe-3755f1d766de", "comment": "Malware payload (Vidar)", "value": "469a4c1241ee3f7d10b438b086f03593f152bba18be8f706d03f3b4d112af8c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764554, "uuid": "4009bad5-4d98-49d5-bccd-14fe5972ff73", "comment": "Malware payload (Vidar)", "value": "98c984f03a3fbf08025af71796e00ed565cb83a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764554, "uuid": "6105dfbd-2759-4e58-9d6e-660be820f32a", "comment": "Malware payload (Vidar)", "value": "e602d51ace35c96e3bfd60cb5efac43b540050b5dcb84e8aa487a8ce201026efe973fe4c2ecebc2273c8e2987a075eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764554, "uuid": "07f13e80-8a01-43c3-8f7f-ae52aebdf4b0", "value": "T1AE464A42B810D5A9C0DAE178E9E6E2957230BC86573537C31A137A721F76BDF1A3E318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764554, "uuid": "a5a38048-1353-4ea2-8ce9-b9d4d874a9dc", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764554, "uuid": "f7d4504b-b877-42d1-9d3f-18d02ab9d335", "value": "49152:nsB4YEDXXCh9NqBg+ISmmg7ID1SU4GU7jwR+dLfMUyzfz7Kp4BpOVg+5nA262fgH:sICJlU8exKo4b6OgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764554, "uuid": "61fb8d52-4571-4842-8641-6534e6aed730", "value": 5849512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764554, "uuid": "f2ce7327-ad3c-4aa9-8c77-761ef325f55c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764554, "uuid": "f27a3db6-5d12-4413-9f33-6c679d7b4325", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ec13a6-d059-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764774247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774247, "uuid": "54555d9f-943e-4bb7-8e95-aeb96909ca29", "comment": "Malware payload (Mirai)", "value": "aca0a6d2c8696c2c2729685b96a56d9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774247, "uuid": "55e4054a-3df8-4e46-bb51-391addba8374", "comment": "Malware payload (Mirai)", "value": "46c184ed8a33a88dfb7ceb780cba7c139071c45b078a27ac873e47610bf71bfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774247, "uuid": "9b16a5a9-0509-44a7-b644-df643d987e36", "comment": "Malware payload (Mirai)", "value": "952dfbc0de2e78690727bcca0010a2fefae9edd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774247, "uuid": "60c364c3-ede2-4ddf-a811-fe76b3d40f1a", "comment": "Malware payload (Mirai)", "value": "43ea9c41fee5a8e69de9232eb06e71764359240b5a021c90e7d6ef1a37164dd996ffa92c2fa82dc99390d718a898a68e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774247, "uuid": "06a33d28-2bfb-4028-afa1-9ecee7872408", "value": "T1BAD3E81E6E648F7CF769C73887B78F31A399239232E1C685E17CD2111E6028E541FB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774247, "uuid": "ed53e5c3-766f-442c-91f3-946a5b05bf40", "value": "3072:TZ8ytWvwDTN/OayQiobonFwAazgzdinqZLa8n5:TZ8ytYwDTN2ayQ3boFwVwAYLa85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764774247, "uuid": "7bf0c25f-0eef-4cf7-a5cd-9f3678c7738a", "value": 132720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764774247, "uuid": "2b7770a2-e678-4903-b0cc-f9d55f72d596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774247, "uuid": "7e8cfc70-61ba-487d-99de-a624f1df95f1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e81972-d04d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764769316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769316, "uuid": "cbabf98d-2bf5-4a3b-8d45-22b65647437f", "comment": "Malware payload", "value": "39f361c14f6aa7b97630ede18e32c64c", "object_relation": "md5", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769316, "uuid": "eae1918e-8f54-4cc4-9d99-a6178606cf4b", "comment": "Malware payload", "value": "47ac6bb89ea9ae1c1ccd26d640f1a53082906262f1b6ed300e09dada1435d191", "object_relation": "sha256", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769316, "uuid": "97de21f9-d7ae-4af9-8530-046787882e46", "comment": "Malware payload", "value": "781d4f79ec8fecee06a4fb7164f519b08512524e", "object_relation": "sha1", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769316, "uuid": "472d3746-b0ec-4572-acd1-db91fd3bb78c", "comment": "Malware payload", "value": "0bd6eb9d318d729a80d51cc6c75b0b1a6531ca9efba715d9f9971415e170a6944d75c32e69995f312354c1f9b8e92761", "object_relation": "sha3-384", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769316, "uuid": "94e45a2c-f6f0-4486-af14-a9e1449c024c", "value": "T1995533B9D1E93E1FFA04D7B7385009566D9A1C1E6A4AC5C2E385F1AE0D1F7838264F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769316, "uuid": "fb162f76-6c51-4d95-8224-fcda954480bd", "value": "24576:QHOCJVlJ0beulxgseHjp7qANV3J5t7dPn+GfUFgBwLJG8SQ83EJZcQ7Kjcf3Fw/d:QukVIbLzgxHd7NVZ3x7fUFMCSQ80JPKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769316, "uuid": "d5bb0a07-d144-43f3-ba66-4d1495fe276a", "value": 1350512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769316, "uuid": "cba21248-48fe-4d50-baa0-ec6c8842e054", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769316, "uuid": "59e7e8c2-2960-4e6b-9599-d6dfd75e7b98", "value": "5192519e273730576cdc8e982aae4b1faf3153cdc6c3bba53d2149875df28b4c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a91b71-d000-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736037, "uuid": "d68f344f-9a4c-48cd-8719-59599fcb2718", "comment": "Malware payload (Mirai)", "value": "38828fe0d7cd83bf1400de6cb9ead892", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736037, "uuid": "98ffea48-d3fe-4cb6-9c39-f6f3362a0165", "comment": "Malware payload (Mirai)", "value": "48b2e2f4114ca8052cd2cd9caa547747832b01bbb976cf420461053d88cada42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736037, "uuid": "28e2d888-ca45-45b8-843f-fc00340ecae5", "comment": "Malware payload (Mirai)", "value": "01dc0453a0c66aa938b93e56fbf23bad643a3009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736037, "uuid": "4793b4fd-50a9-480f-bd6a-b998382e0ad0", "comment": "Malware payload (Mirai)", "value": "727cfeb4be6a94dc2f234b1226e606aa27cc97ed969219ba43d8b741e39e2120228801083e39ca27e50d8574502d1e4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736037, "uuid": "b97d607a-887b-4b6b-9c65-987775119c1d", "value": "T1B4830786B94B80F5D80B48746067F23FCB32D5B940A1C74DEF6AAF35DE339415A262C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736037, "uuid": "cddbb5d7-aae2-4da4-ba79-c22793272878", "value": "1536:teIfIJz5qRbcu41s5YtkAMWa65C60n0E00iG7:trgJNqau4m53+l5C60n0hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736037, "uuid": "0504ccd4-8cf4-40de-a8ce-4c4c06cb5c30", "value": 83440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736037, "uuid": "aa110156-bca2-499c-90f4-8b2d4aa4478c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736037, "uuid": "a4f39404-252e-45a8-86f2-f732476fe344", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc3d2d5-d0a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806186, "uuid": "e0f9540f-c8fb-4c80-affd-14b0bd0364c7", "comment": "Malware payload (Mirai)", "value": "10cb586aa62cf6e01fa38a95c0241b22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806186, "uuid": "5bd94e22-20b7-42f7-a46c-9ace1a0c31bc", "comment": "Malware payload (Mirai)", "value": "4919eb764f328e68e20c3104edb426501fdd566ec3c87207e86818ed91736db2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806186, "uuid": "f9b1029d-cbb7-40c1-bbe7-c2814c4ef852", "comment": "Malware payload (Mirai)", "value": "f511cfc3f41afea0b43ca7ea062b41944c59b24a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806186, "uuid": "38ed4a4f-6dc6-4260-9c88-d17206497588", "comment": "Malware payload (Mirai)", "value": "0cba459467feffdd5b6b78f6029c2f89461bb18d537d21367d695766858497ccfcec1f5c2acb89f6f99bd05bce1851d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806186, "uuid": "fadb5bec-68d9-48b0-92e6-9f819d51fa32", "value": "T140B32980F98B81FAC84B883060A6F63FDB31D9E94173CA5DEF999F32DA37941911164D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806186, "uuid": "9d501b8c-8939-4b51-97c6-960d9c8af58a", "value": "3072:okfZVtG90PZAMi5TjRgFydm5Y82Nofh/wGMmBa1CPji/Jc:PvG90PZcBVgMdTXNofhAgu/Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806186, "uuid": "5d735788-6962-46bc-8f3c-d401323b469a", "value": 116624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806186, "uuid": "a1130b13-9d42-446a-b13d-16b74299b842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806186, "uuid": "f91b15c3-84bf-49d4-be21-62e832dd095e", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b677862-d017-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764745837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745837, "uuid": "78e11e80-0528-4d99-bfa6-232ef25346e9", "comment": "Malware payload (XWorm)", "value": "e155329c669676225586d411496c65f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745837, "uuid": "82c025d9-9d0f-4857-ad54-b50e87d1d13a", "comment": "Malware payload (XWorm)", "value": "49fa3f417ef93be2408ad394d41ad4719420c6608b19b3dfa74d32299010073c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745837, "uuid": "93520ec5-e42d-497c-bbe6-145645e3c8e8", "comment": "Malware payload (XWorm)", "value": "923ae5c08b95e76a21d662652f47ead7cd6edef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745837, "uuid": "34d9852d-539c-46e7-87e0-d7bdab4dd6d2", "comment": "Malware payload (XWorm)", "value": "5349643c71ecbf17bdff70537ee2466448a0e072338e00b2414a3c5b57e2d667d71076836ebf9812ce155a7c99f44121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745837, "uuid": "acad3154-58fa-46ed-a2dc-7e99f0286b49", "value": "T1A4E39D00B2D1D47DE9B6167648A88DA49A2DF9304F14DEDB73C8C4AE4F704D0A93AD7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745837, "uuid": "fdb929f2-65ac-40d1-9857-641d20701737", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745837, "uuid": "6a8b8069-9b25-4b3b-8501-950bb1fd0603", "value": "3072:63AlCua6Ty3XctCkh3jBzBueU9audXzWcXaw3aRHcnIBX2QTkM:/lHWct/jKdXf3aRHcnsX2IkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745837, "uuid": "3e61ef7b-9328-4466-b116-51d99c4bf377", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745837, "uuid": "537b5222-3aab-4a79-af7e-37869d59b263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745837, "uuid": "aec5c0b4-1642-481e-9882-aa7a00b1dfa3", "value": "49fa3f417ef93be2408ad394d41ad4719420c6608b19b3dfa74d32299010073c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b064d696-d049-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764767535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767535, "uuid": "3e5bdf24-eeec-4007-a3ce-5100b62224e4", "comment": "Malware payload", "value": "5bd5f08356cee0d11e97e22f870f26f7", "object_relation": "md5", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767535, "uuid": "88121661-2b66-4490-aa8f-491f4b13cd10", "comment": "Malware payload", "value": "4a123fb136988551c748b0368b35395afdd34e50c757d56a79904f6767f96db7", "object_relation": "sha256", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767535, "uuid": "8d9fca1a-33c9-4f9e-927f-d5987aa70654", "comment": "Malware payload", "value": "1e6d9ea607b1f5829576beb134d385eb8838df27", "object_relation": "sha1", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767535, "uuid": "5c9ecad9-397c-4176-91f1-8b8a7894052c", "comment": "Malware payload", "value": "79502b6a8d600462da2bcf2ff73c6fb916e61b67f01420ac8c9dd91a97496aa198ac262f037f9d112c2e6bd85829bc57", "object_relation": "sha3-384", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767535, "uuid": "0ad5a44b-e3da-4aaa-a9ef-e6e27102822f", "value": "T1DA55D01136D4D832E4B2527459AC62758B6EBC702B35C9DB238473DE8DB13E2AB3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767535, "uuid": "ec0d6901-a006-4de9-9cee-5137a1caff2c", "value": "784112ee3c1da4bbf1f4ee95a0d306fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767535, "uuid": "f3ff3cb2-52a2-4de8-8653-e91cf4099faa", "value": "24576:fXTff2BiQ6Y3lfbcXqOXm67gLEuibeX57XIU9wwXfNce:fXzfSYkdO7gLEuib87p9wGce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767535, "uuid": "a37f899f-a853-4cca-9fc8-ce484ddbe425", "value": 1283584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767535, "uuid": "f954145a-cd6e-43b5-9e2c-de9793c1f908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767535, "uuid": "7857e43c-11ee-4cc9-8814-76cef37b30b0", "value": "4a123fb136988551c748b0368b35395afdd34e50c757d56a79904f6767f96db7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d722f6-d063-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764778769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778769, "uuid": "bd261120-3c0b-46c0-a19f-15be36ad3d3d", "comment": "Malware payload (SalatStealer)", "value": "7e35c2827815745a175fb618f9d56880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778769, "uuid": "a4966f19-dd83-410e-8730-0c31569da984", "comment": "Malware payload (SalatStealer)", "value": "4b034df185a00e490091a9c0c1bf4944c0e9177017cbcb1b0d61d937a87f8cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778769, "uuid": "cf1c204d-98d9-4cb1-b106-7ff4753696b8", "comment": "Malware payload (SalatStealer)", "value": "0bce21953d40e19a9772cdeab9ba41fba199e8a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778769, "uuid": "afbf5df2-ba62-452c-8b87-27c779ec5c0f", "comment": "Malware payload (SalatStealer)", "value": "b482f797f8231bc0248911f1f99a848009bd6f99690bd3bbe5b14c72a949e20a8d983fed8760af05266e09b9bf0187d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778769, "uuid": "6b917edc-fdba-42c5-9e2e-e9c91c092a83", "value": "T129C65B41FA8B54F6EA031832415BB23F63305D049B28CBDBEB547B6EFC77681197A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778769, "uuid": "f358bf09-17eb-4dfb-980d-6ed7f7c5b9fe", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778769, "uuid": "734a1a0a-1535-431f-9974-b1fed9543a72", "value": "49152:IG6Dsyf57KbEhu6sTFWb/1ekLsMBwuPeofNiaty34N5p8xiSVlQtw5yXz0pqyZqk:nqsw5Dupx432VYiRfNdv/KsPrkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764778769, "uuid": "26acfaca-3267-4ab9-8869-ecce2d22e698", "value": 11654144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764778769, "uuid": "2f983357-67eb-45a1-852e-6c633775f524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778769, "uuid": "62a1ff96-4412-4ff1-a2ad-661350081ab3", "value": "NeverloseCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e9c112-d095-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764799999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799999, "uuid": "92a6dedf-055d-4b47-ad36-4fa91704a587", "comment": "Malware payload (Mirai)", "value": "53995c6dd1d9c7303b8104a479180ca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799999, "uuid": "8d9d1496-dd3d-4485-89af-72134316a62a", "comment": "Malware payload (Mirai)", "value": "4beda8ec1b752260446e3f70e0ad2a853f41e1191e8b550c38317b42d236e057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799999, "uuid": "4df0ee4b-f9d5-4d5a-9f30-e0b7f1fd54ac", "comment": "Malware payload (Mirai)", "value": "7d045778fdfc126a4bcbef9ac7a03099ff8495df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799999, "uuid": "bb662cf8-878b-4685-9e7b-837baf1731bd", "comment": "Malware payload (Mirai)", "value": "f87ae8ef3e6e451984a46dc72dcc3662dd7c156dd545e5e7e199114804b84d35d0816f4a4039a8b4fe37bd56c3760aba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799999, "uuid": "8de3463f-121b-4f84-a1ae-ce867f904c54", "value": "T15153F781F8D2896EC5D0237AA77E358E3361B3A4D1CF3217CD685B217B8568B1D6BB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799999, "uuid": "da03f631-37ab-47bd-aea0-502bd57b9f15", "value": "1536:HI+eN59JlQZ+Y7cOE8ZA6qaWwgkDyRmJ8:HI+eN5a7tjWwfd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764799999, "uuid": "1f6a7b45-9062-41b6-aa4b-266e18415ed1", "value": 62904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764799999, "uuid": "0ee7a4a5-0c06-4fdd-97e2-cbca7da7b8f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799999, "uuid": "c5c1f3a0-b6e9-42a0-bd40-b3de11ce03f9", "value": "zerobotv9.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d459171-d091-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764798266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798266, "uuid": "d1912c6f-a84e-442b-a984-0175186f2939", "comment": "Malware payload", "value": "13dc04dceac4cc9aabefffb6f960e3b1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798266, "uuid": "6b58b3f2-4453-4bef-89a4-ae619ab369ee", "comment": "Malware payload", "value": "4c97309d72574811d20fc08a982d80b493816c92e8f820f293489bb7abe568b3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798266, "uuid": "bb415b7f-a53c-4875-8b47-220760aedf0a", "comment": "Malware payload", "value": "fc1e3bfe421a255892edccc2b0e36753d93585c2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798266, "uuid": "d37b9a1c-d385-4d00-aea5-b8dff864c789", "comment": "Malware payload", "value": "ffec4ffc4eab926524caccb1666a64a0ed18292d5c9846c4adc36c29312a15e2eaa34d2ee29dff0e253ec9dc5a1d5c74", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798266, "uuid": "4926b8e8-65cc-4807-a361-c97da77c7b42", "value": "T1A173A64809CF41E8AE277458A9DF4C02FBE48507063CE6F5FB5DA9E0AF6197891F85E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798266, "uuid": "5a111f68-a121-4554-876c-7f2c0db7f98e", "value": "768:b7wqWTdCvTlmFc8u5xj5pKBdZLOzqcEpobtxAfAJelJ7o/PSMhsyRxuI6lgttwOe:j+PVwqcEgtxAUSMgU1z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798266, "uuid": "69245300-ea01-4f35-a80a-15fc10599c4b", "value": 76790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798266, "uuid": "460b12da-8e60-4006-bc6f-94e1fb3e1743", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798266, "uuid": "39868159-0dc9-4e1a-9c71-afc44dca95d1", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b17517-d01c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764748141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748141, "uuid": "c2cf1267-0e11-4197-b4e4-8319750b4293", "comment": "Malware payload (Mirai)", "value": "89a4e1d70fd87f96efbd38eef1059825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748141, "uuid": "c135d2c9-4427-4f87-bad5-49c006e7c4f5", "comment": "Malware payload (Mirai)", "value": "4cb6d4f4c79bbab24afd0822d0f8cd3a047c16f39f48b2f5af346e6e63ebf714", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748141, "uuid": "cccb4f4b-68fe-4926-8dfa-9a94ba976927", "comment": "Malware payload (Mirai)", "value": "dc4f8e4521fcc6243d9732167b53ab004f35cbea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748141, "uuid": "123e7b06-ce97-4e0d-80c1-3dc2168b5c4b", "comment": "Malware payload (Mirai)", "value": "11c0e6ea9432221e92ae071054eea1f7c3941b0efa0391bcae1906ad0c9541381a8e0d3061f0bf7fe23baa1d6bf873be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748141, "uuid": "7e5c459b-f69a-4825-b576-4ec2026b1fe5", "value": "T13BC36D21B9391A37C4E0647B11F74326B1F257CA21A8CA5E7E720F8FFF116502A57AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748141, "uuid": "42a0f13a-29a8-467f-a0e6-20e485de6feb", "value": "1536:q+SwuRLs0WlvxAhFIphz1EWjzR9y6dYQO5rsVGUNjiW1wHwrvwXt4Jl95R3t5cw:43EPDvdYQBNjvIuJlPJcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764748141, "uuid": "f1d56ba8-07eb-4a74-a15e-968c7d680102", "value": 121584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764748141, "uuid": "5ab2a663-5176-486a-a80b-0167649cf563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748141, "uuid": "a9bf2a44-be74-48a4-97c6-17fe5a781848", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a95555-d093-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764799134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799134, "uuid": "c33a8514-f389-46fa-af7a-754a3e2df7bd", "comment": "Malware payload", "value": "2e0dfc4df82c0fd5e30f24683bef9016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799134, "uuid": "e338add7-a41b-43b8-b990-2dae0ebbeea9", "comment": "Malware payload", "value": "4cf973d3c8985c32572680203bc01121cf18342f75c139ec0fb202900809917c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799134, "uuid": "3e8e5086-5ce9-4b6d-a393-451f37d326db", "comment": "Malware payload", "value": "0d77e926449c0a19f74884d7b524c0fc5c0de753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799134, "uuid": "f9d79c58-4a2e-4363-8133-e96707b08f32", "comment": "Malware payload", "value": "ce44a5a242674c70c8f44d7553a38ab70ea8849dd8a84a7c13247b479702dbb0a7f7805b92d96f38ffb443c1644d69b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799134, "uuid": "5a82a3ed-7e9e-41c5-a6ed-62bdb8376ba9", "value": "T1E9337D17AB0C0E23E6AE49BC54B56B172EF493229471F3CF1C94C19DA9673C11A262DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799134, "uuid": "6a5ac008-bedd-4ccf-843e-37b5460bad12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799134, "uuid": "0376b57a-1070-4e1d-a74e-bba11803810e", "value": "1536:2XhJ/GtyZcK5S+vV+PO8Kq/mfGXq/UrToVb:2XhJ/Gty6QS+vV+PO8Kq/mDUrsVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764799134, "uuid": "7dcb40ff-924a-460f-9c36-8edabc3d698e", "value": 50448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764799134, "uuid": "f885d6be-cd6b-4072-ac53-8ebde790146a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799134, "uuid": "41f8a16c-2674-43e7-862b-2da4dc52c9db", "value": "photo202512046899u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3715f64d-d084-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764792672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792672, "uuid": "fff39cfa-671b-44a8-8741-90b76526aab7", "comment": "Malware payload (Mirai)", "value": "b538db7591d844f8a5221ccab1d050e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792672, "uuid": "ed38757c-ee80-4b73-bedd-f9c50d31a2f7", "comment": "Malware payload (Mirai)", "value": "4d0ff47525b4e8de5005a1239f8450f1a1df266b36c8f1fb0f3e63c96959b0be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792672, "uuid": "936419bd-a100-4b24-912c-7b5f358b1089", "comment": "Malware payload (Mirai)", "value": "6342f98041527a112432409aa341ac7e901daf2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792672, "uuid": "112217e5-273f-4b68-afbf-f6eab1e7a183", "comment": "Malware payload (Mirai)", "value": "f498b09361af055517da812cabeac906a97e9d56f8e042e1def10c90d710db4cf66082a28407ba77f48f00d047bfd943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792672, "uuid": "de3f327c-c148-46e5-b281-11e8b9749dca", "value": "T14213E168D1509E9BCAAFD8B0DC787581B6E21F47B6A6DF92724DFD009F4500D21C1EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792672, "uuid": "62e60d45-f894-4b82-bc56-b5eba1b224ae", "value": "768:h3R6OSO/wfEg+0LHJtp22AbGI7f2XhS9L1Sdd4Ux9+vLm5Adm54uVcqgw09Rl:yOoAa0f2k9ojx9+K54m54u+qgw09Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764792672, "uuid": "f5776a9a-ae1c-4d94-a338-c2e01e7eae8e", "value": 42228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764792672, "uuid": "c50e7771-4bd7-440f-b3e6-e04137dbd9f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792672, "uuid": "de936fb1-122f-4666-b82e-117498aeaf1d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc571789-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764768039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768039, "uuid": "ea23cf7d-e047-49ec-b440-540c86036eb7", "comment": "Malware payload (ConnectWise)", "value": "0ceba3692ebf83df4be2ccc491d5a68d", "object_relation": "md5", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768039, "uuid": "755dd8b8-8e7b-4248-82fc-0946d0611480", "comment": "Malware payload (ConnectWise)", "value": "4d7e3c3d91240fc1ca5765ea2bd4f315aba296b99c141e946121d35c7ab525b4", "object_relation": "sha256", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768039, "uuid": "ad323921-f32d-428c-9202-64efa1203e56", "comment": "Malware payload (ConnectWise)", "value": "1fa2b74dde7376b8ac652a110e5c9775e86f5565", "object_relation": "sha1", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768039, "uuid": "361a17e9-3b1e-4b74-a5de-d4ba831870c2", "comment": "Malware payload (ConnectWise)", "value": "f89f6088ae8ec101a4dfc506e5edd333db9c806d1a85c611b2beec13ed3a74b511de751db3bb94f151601a4cc29a779a", "object_relation": "sha3-384", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768039, "uuid": "2ffebb47-cada-4565-96e7-751d0c06bcab", "value": "T113650220B6E5883DEAF61A36FF7A92615F39BD251B20C15E8394390D0D70AD19BB1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768039, "uuid": "3df24a94-cb38-4460-a3a5-759d3823151e", "value": "24576:nZPlmF0uwTKh56Z5vePu/DVeL1pVjeOJnUUGGu/aYmQurhwQUv:Xmh69eWbVypVCWgGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764768039, "uuid": "3b39f12c-6486-4533-80c8-543d34c63d85", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764768039, "uuid": "245664da-d1f5-49ab-b516-3f11acf147e6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768039, "uuid": "ec9d82cf-df99-42bd-97a4-ca4bd18d0fcb", "value": "4d7e3c3d91240fc1ca5765ea2bd4f315aba296b99c141e946121d35c7ab525b4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87eaf62b-d062-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764778205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778205, "uuid": "566fcd55-c59e-48b8-9083-01dcd8f862df", "comment": "Malware payload (SalatStealer)", "value": "f157efac383bac30af4319294015cfd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778205, "uuid": "cf6b5fe7-1f15-42bf-9687-766721f9e4ee", "comment": "Malware payload (SalatStealer)", "value": "4dbdb20f155314cc024c0dae1fa82e421516e5cb9075e7bdb12f6dfca2eaa2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778205, "uuid": "aebe731a-a735-4257-be32-5dae0da0db41", "comment": "Malware payload (SalatStealer)", "value": "e33c14aee03ddf391447f481a18db547cac4ba01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778205, "uuid": "894f8ec1-4c45-4bf6-901b-39f9f41b5a55", "comment": "Malware payload (SalatStealer)", "value": "b4cdef48bcf57b2fe9870227c38d94a6611204c604b2ec21d8d7e7bdf0d69aa2097603c26fb6b53bb8fdc08305403956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778205, "uuid": "a1c7e129-f6f2-4dac-abee-cbce31fbfb15", "value": "T175E53313C9D84891F0FA5278ADFA97543D370D3AFD26DA4787AAB772ACAC3715C44820", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778205, "uuid": "d879ca5b-b1d3-4cf9-ad46-0ed7debd17ff", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778205, "uuid": "14563257-ad49-4876-83a5-83a7c9e80cf5", "value": "49152:rElBWngSpk8sK4clKjjk2lhncukKr56uweKscYGsqI245RpoOECa8OwmiI:uBWnvk8gc8LlKu756JeKscYGCG7Lw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764778205, "uuid": "76ffece4-0783-4e16-88e3-a67330ec3b31", "value": 3291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764778205, "uuid": "f3c455a0-4ad6-4d35-9dc2-fb412035ff94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778205, "uuid": "7d18fbee-0643-4690-8762-a2e2dd6e0605", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d87093-d066-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764779842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779842, "uuid": "0767f044-fe4e-47e4-8333-9d5e80e88a80", "comment": "Malware payload (Mirai)", "value": "19a48bcc85e2095541285f5d1f9d2505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779842, "uuid": "565f900e-a7fc-4223-804a-f72a24a5382c", "comment": "Malware payload (Mirai)", "value": "4dc1581c6e85fc4f45e3797d256afca8f2755cb1b433daf07d05f795e9c7891b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779842, "uuid": "63359af4-9e52-448e-98f2-a9f955c047d8", "comment": "Malware payload (Mirai)", "value": "a71b583c31466dbb1bf43b8ca38ded626c1d8db6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779842, "uuid": "bd92b518-0fd5-4529-a71f-6bdd59f5619a", "comment": "Malware payload (Mirai)", "value": "f7c32833a3966c7a4a43a4af6ddb62b2a86490f5d9435e89e77c54cf20f888b3bc67b0cbc3376b7c17a5db4655584d54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779842, "uuid": "8ca642d0-2639-4631-8d9a-814f9540da2d", "value": "T162C32B81F68741F6CC174934709BFA3FDA72946E4136CAE9DF988E35DA27A01421B34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779842, "uuid": "541f9c6b-6421-406d-bf58-120ba95bcc7f", "value": "3072:aW6GQudy3DREum5B3ZBtziRNpSE5RmyfSl:qudy3N9CPIza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764779842, "uuid": "302bb813-7527-4ca4-a5ba-1ff2bc0e3360", "value": 120208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764779842, "uuid": "67c43451-766f-43f1-a84e-fb3680a93568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779842, "uuid": "87e92260-27e5-4a23-88c5-adca929632c1", "value": "Yboats.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a9fd0b-d041-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764764187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764187, "uuid": "e246694a-4d91-4f84-b719-4318f79a03f3", "comment": "Malware payload (Mirai)", "value": "c5e70d27dcd7f8bbf1bd4ba4e9a4373a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764187, "uuid": "889e2202-d87a-49be-adda-259e967bc8d8", "comment": "Malware payload (Mirai)", "value": "4f36c02269bd197c493c0a51a7358377d1f2b6b69167db60dbbb231802585e2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764187, "uuid": "b6e41744-1b56-4c2e-8083-16618fe1a1e0", "comment": "Malware payload (Mirai)", "value": "f21ccaa2e21bc5adb7eff8722c1bf9ef1ea9b454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764187, "uuid": "35181ae4-66ae-45ff-bca1-bbd86a761515", "comment": "Malware payload (Mirai)", "value": "2eaa27abd1863cba00c7cc2b0a0334863248adca0261845ccfeced317540fc3231f385697f0d12aa73201f2b3aa92d68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764187, "uuid": "2aeffe3a-7c24-44ee-8e5c-60cfefc048c7", "value": "T1A8130210B5C635FAEADB2F345EBDB246BF9208C1F6311EA48158FF254B05BD2E2185C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764187, "uuid": "440f91ae-c993-4b9c-90a4-70ffebed9bde", "value": "768:lBYi0bBj/+rA5ae5BfC5VXTN5fLw7oZ1VUABbeqFqJ4uVcqgw0RTWXj:lKi0bBjiADBq5VZljDBbjYJ4u+qgw01Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764187, "uuid": "fe0d2e5e-3079-439c-a0f5-70c1e060cdab", "value": 43328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764187, "uuid": "502e579d-86bc-4dbc-89ba-3091d55c44f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764187, "uuid": "75421621-2f1a-4c6d-bed1-d69bc57d3b5f", "value": "Yboats.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b28d0c-d05b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764775171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775171, "uuid": "1a04453d-02fe-4253-9c6e-39acb9989502", "comment": "Malware payload", "value": "afc5013d42ed12d281e49d2a89d6482d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775171, "uuid": "b357bf64-449c-48e5-8b99-6da5bfdfff34", "comment": "Malware payload", "value": "4f49fe2c15de2c17f015e1f7e4b5c9a32b47424b39d363457f8f03eed98ef922", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775171, "uuid": "207e2e7b-ae24-451c-8a2b-040fa1cde546", "comment": "Malware payload", "value": "0a18a436fd99fc66f304eb103bdc76f0d9066a0c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775171, "uuid": "79528732-5e0d-4068-b8d4-94b0cf0e6c42", "comment": "Malware payload", "value": "65c9b288ad7f541c93fdde8c31d32b411c3fea87c83db23814d7e67b0eb18b968bdd91e62e0be5ff85382673b3c6bd6f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775171, "uuid": "5462770f-7b60-4cb4-b987-52f98f37a4c5", "value": "T1FF8733C8FCC6EEFDD55C9138CE9B87696F4CEC944F81009670B835A136729AA427970E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775171, "uuid": "ed947d61-10c9-4f46-9d73-9c496daf65f8", "value": "786432:0FE+PWP7dKOVa0Jf6U/tWbdt89TpTLIo3/gnqZjaoyWd0Cyy6J+u3:OPa7bD6U/UtqtLBPgnA2TWTjID3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764775171, "uuid": "0550b967-834b-4b1c-b951-334d951f3f02", "value": 36958208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764775171, "uuid": "27728eb2-da44-4acc-9822-6ce7ac06b86f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775171, "uuid": "0a9925f6-59f2-436a-8db5-b8459b3ef288", "value": "RustLuma.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9841eb39-d095-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764800137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800137, "uuid": "d8d44c2e-6344-43c7-aabf-6d27af7d7c20", "comment": "Malware payload (Mirai)", "value": "3f14b74770150e191882a35582c621f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800137, "uuid": "6f1d4655-7da1-4cb7-b24f-a090a15957ad", "comment": "Malware payload (Mirai)", "value": "5006a49c41fd286ef1191522949ede4fdede868c5000af670aa802fd19818757", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800137, "uuid": "d9df492a-f2a3-4fd9-9794-ff3921b848cc", "comment": "Malware payload (Mirai)", "value": "6fc3430bd087115c0e1f2d2fb89cef49cac177d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800137, "uuid": "b7b98865-f5e0-4886-9beb-ab08337158a6", "comment": "Malware payload (Mirai)", "value": "9abd5927143188a3a01e54b3916c144cbe148f714fbadc8119cc41fafcf28958d9a78d5d2df02b8f86c5ae3297bdc0b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800137, "uuid": "17a5d22e-7162-40bc-aa29-a766de43a220", "value": "T148E30849FC809B11C4D635BEFA0E028933535BB8E3FEB112EE155B2227CAA1B0F36515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800137, "uuid": "d952e1b5-a71d-4910-8654-7615afd2862f", "value": "3072:eoOo9RU+Kzzo5A5WdjaFilBfJR1LFqLgE0fXaesAFZFmgtJS3dBCeP:JVRdOWz1LwLgffXaesAFZsgt4Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764800137, "uuid": "4334c4bc-3f5d-4152-a6a2-3397ebf0c9fd", "value": 155124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764800137, "uuid": "75a96705-c2ee-45f9-9905-2058edfca71c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800137, "uuid": "64649d2d-1fb6-4364-a949-1c3aaa994cd2", "value": "gang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31169a4-d02c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764755165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755165, "uuid": "677b3a85-9764-470a-af83-00fc4e1b5057", "comment": "Malware payload (Mirai)", "value": "a2d8b49b1c1ce41283d243f9d3f131e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755165, "uuid": "fca183e0-3fb5-4b23-9fe0-93731ac03f2e", "comment": "Malware payload (Mirai)", "value": "502391ddc571dd6e44edafc40987538b98d6ffb1bae7c72a3f4fe637e2b2e9fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755165, "uuid": "fc4d4d6d-e634-4e5b-b39d-9a6aa13a9e1e", "comment": "Malware payload (Mirai)", "value": "1a0144fe67798516d75b6fff6013f42e743cea15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755165, "uuid": "a2ccb097-f110-48dd-8186-503a703d389a", "comment": "Malware payload (Mirai)", "value": "a1fe664009dfa0fc2b33976089b6e749939ac6562ab56c20b4d28e49436749242bcc6d1551c950a68aa27109347fa556", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755165, "uuid": "2a494a72-7dbc-4e41-b0b3-ed46579928c0", "value": "T148318F87121107B12EE2DDAA76E6D804B581F06AAFC19B46D4DDF8FD889DF082441E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755165, "uuid": "0a013c23-ba34-43d4-9f90-43722e9be161", "value": "24:vL0W/OSl57IOSvJuoOS6KOSCjOSBDOS4OSH8OSr/OSvYOl:vL0W/RgRv/RDRCjRxR4RcRzRQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764755165, "uuid": "acff9bb0-cf6e-4d13-b7b3-283930188325", "value": 1750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764755165, "uuid": "8ef02e84-3c2a-45f1-803f-b7f0b1324067", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755165, "uuid": "105aeb47-a40d-4418-87f0-ee01d9e44c23", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ba7af6-d05c-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764775785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775785, "uuid": "2ca10fe9-a701-44f5-91e4-2bc438c44574", "comment": "Malware payload (DonutLoader)", "value": "f63d7e0ddf3467973ec738325e2b1367", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775785, "uuid": "356b170b-14b7-41db-89e8-2944cbc1ad5a", "comment": "Malware payload (DonutLoader)", "value": "50419b6ae38000b3d639e462f69bb35ff167650ca8eff6eb35dcfbd38b08c393", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775785, "uuid": "2e34c083-56cb-4de9-85cb-371d65550557", "comment": "Malware payload (DonutLoader)", "value": "9077793edca2cb6da2c38c4f40005d8dd1c894bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775785, "uuid": "02c693f8-5372-44c0-97c5-495a19495026", "comment": "Malware payload (DonutLoader)", "value": "867957ea8f14c762cfd10dcbda8f00d1860082c5dd0658b9776c5a118ffc5db3b53fb03434f5881d3ac501db38d4de9d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775785, "uuid": "0e7bd00a-ed26-4600-b18a-025fda77e7f3", "value": "T1E7F3F1BC45B9E34FF1FAE8F4A4416F95DC21BA5D9D12A6E3CB39E3902332A441B156C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775785, "uuid": "1a0f9d7d-a2fc-4213-b14a-0fc199c47fbe", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775785, "uuid": "4a5298b6-ec7b-4315-aa87-408c44a68d9a", "value": "3072:/JHT+CKONZdr4HkYe582PQ9fAnMVO9nUtX/CWiFwOS4iOyggcTIPuc:NTpjr4kYe5824pVUUhCrFZ/iUgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764775785, "uuid": "8e72ff7f-b135-4370-94fd-a3b493e6234d", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764775785, "uuid": "fb111d0a-315a-494b-8dd0-3f577e21c9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775785, "uuid": "453bdc96-94b1-41bb-a61d-9465fa7274d1", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fb813e-cff2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764730158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764730158, "uuid": "23c46e9f-b095-4f11-ab9b-0e0d67359621", "comment": "Malware payload", "value": "fbd94b6b28a77b22c13f5c221a095402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764730158, "uuid": "6a903ffe-c113-4bc4-9ec2-3145d61712bb", "comment": "Malware payload", "value": "5094adea3ae4d0374a126b2cf316c1f17a2f8eceb2b1c76fd5b334ccf4a85dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764730158, "uuid": "8305cf8c-8045-4fa6-90e7-156ea1622430", "comment": "Malware payload", "value": "0ff2e74942ef3b9eaa2e759ed44438d8bb46a02e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764730158, "uuid": "c639af4a-96c9-4edc-9a8b-65ca7bde3ab3", "comment": "Malware payload", "value": "4fe4362fe4fd1834ddc466235e856cff68fccdde4d6ac6ab64d67134274cff91e7190da121f6d3cbc9b7c9eb6bff6ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764730158, "uuid": "c50a6dff-609e-4026-aa40-6638e8f1bb0d", "value": "T15AD623EE54A522E0E4D30AC0778643CF71D0656A5AED5C3C39DA2C016F21D6FA14EEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764730158, "uuid": "9c360281-9c9e-4dff-90d7-5fa56c8e1ac9", "value": "61c4c9c0ec824b01eb6614eb012d0426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764730158, "uuid": "bf817a58-88d9-4c73-91eb-405cf930d81f", "value": "196608:xkbOcUjzrBm03Zs2JMnK2PmShykXAtzhXBN/5AQ7Q1sh765pbSoMn8P2RZRM+rTz:S6vXWVK2lhyiA/XBN/5A51sAl3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764730158, "uuid": "a499959f-f94f-4800-85b7-f78362640c76", "value": 13830144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764730158, "uuid": "1179f55a-0f92-437d-b1eb-169fec220ff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764730158, "uuid": "e4742ac5-f6b2-4b5e-81a1-3868d6bc8288", "value": "xzblib0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae365ab1-d04d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764769250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769250, "uuid": "33889321-0cb9-4c03-a11b-bedc49d1ac0e", "comment": "Malware payload", "value": "48a8452b078b5bb89cd4daaab036ef6a", "object_relation": "md5", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769250, "uuid": "66d43aa6-3c3d-4c62-a187-d6d6ff1ebb57", "comment": "Malware payload", "value": "5192519e273730576cdc8e982aae4b1faf3153cdc6c3bba53d2149875df28b4c", "object_relation": "sha256", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769250, "uuid": "08660a3b-6bce-400e-8d12-4cb379be087a", "comment": "Malware payload", "value": "f5bbe45432fafeff47f98a3fc48ad1aaaafde12a", "object_relation": "sha1", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769250, "uuid": "e9bc8b8c-4355-4b4a-8f6b-78381f6d67cd", "comment": "Malware payload", "value": "d983abfa7d01e876520d03c56e1ad6c6d6e7addb42bce5e3d4294c711e4bb30ccbddd978aa5ecfee2d4a213f9b4ba5f5", "object_relation": "sha3-384", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769250, "uuid": "3c522fda-e584-45c7-a0ee-9b1ed58e0b4e", "value": "T1E236C0B8F48D8CCCE88AC639D57A355E4B0EB10F6ACD3884353D0A55B3066A4B75379B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769250, "uuid": "ac0aa89e-df7a-4444-82dc-7a97b8a3ce20", "value": "24576:O/C/9ZJODwZcV+xhAGd3t7VpHMkhQFr7+Lru8zN4k/uRHRbl7XBEEEulZNJNIw:O/I9cwZw4d97DhQFnI7VGXblVEEEAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769250, "uuid": "6501aae3-33ff-4beb-bc13-56f4a7ed16e7", "value": 5243392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769250, "uuid": "a0598c07-d819-4f35-8071-59cc64f79b59", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769250, "uuid": "7744cfa0-c7fd-4ccf-9927-3609e371a06b", "value": "5192519e273730576cdc8e982aae4b1faf3153cdc6c3bba53d2149875df28b4c.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d52a823-d022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764750511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750511, "uuid": "6e35d336-8c0a-4f65-9540-752d6ab45402", "comment": "Malware payload", "value": "cc9bfdadb9c4e93dddba282a04905167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750511, "uuid": "79a987c0-b8e4-4a97-bea0-b1ddbc257fbd", "comment": "Malware payload", "value": "523f54f5b1996c9740919899e5df05292092c5ae9fd0ef633e191a4acfc609e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750511, "uuid": "6992d7de-cf87-4fd3-aae8-a8bd113ce067", "comment": "Malware payload", "value": "b812641104d3097881eb6b6e9a5d56e77723e117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750511, "uuid": "1879d3c3-06d9-4e2f-938d-182a9041aefd", "comment": "Malware payload", "value": "8e1946a45c36c9fbe5e512f3ef8198f37a1bcaaa477cca8d918fb7da8cd751a0680297c248906d6e1364554b7179db1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750511, "uuid": "cd96d1da-f9ea-4ac1-a769-3acaad5affc7", "value": "T1CF942A13AAB84154E132C17C22A7E623F13B380D57E8F6BB85DCDB5B2351A4BB55D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750511, "uuid": "3d5bfef0-b061-42da-8891-c33f317572ac", "value": "6bf8cb67cfa5a770038b21cb9b2dc3f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750511, "uuid": "a35c81de-10ca-42fe-90dc-728fc0075b05", "value": "6144:69A4M6Gf6MWTz0Gs2KijKzmIHg4gppDTqC7lOjw2FoOnhL8j1Fr11rSDtFv:P1izFjKqMQD//Oh8jrZ1rstFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750511, "uuid": "cc7ea653-f6d7-492e-b947-de8c119ccf00", "value": 418856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750511, "uuid": "9975e0a0-3b79-46da-8df5-85d4feeac203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750511, "uuid": "bec124a4-f777-41ef-9cc9-62c8f9d04c27", "value": "TeamsSetup_v7.853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cddf9ea-d02e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764755879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755879, "uuid": "88e1689b-ec18-48ac-b655-89e014c41d0d", "comment": "Malware payload (Vidar)", "value": "21ad484ae2fe3ff53fa073915f6138f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755879, "uuid": "3cb30ab8-8761-4a3d-9d43-0460e019b0b8", "comment": "Malware payload (Vidar)", "value": "526b4b1d14e29c40e4b21404b253cfeb6b9d359e6f2fcafdb192362700a17673", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755879, "uuid": "5c83b3e0-de36-4e7e-8540-6f7b106b1b03", "comment": "Malware payload (Vidar)", "value": "f36bd6adad56a8736383e9931c27108b08aad841", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755879, "uuid": "cff97dcb-f5d8-492b-bfdf-b8c368e1b694", "comment": "Malware payload (Vidar)", "value": "1ac00de29b02c86dfdcb8b353fe08e8a3dc108dfeaf444fcc9d4264d542a5b80a74ab4de54a51f4f38af23cdfe6753f6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755879, "uuid": "5b2d0f60-8b30-431d-a541-1f9d0ac4867e", "value": "T1AC760812A9968479C7A9F23491516251B7317C2843333BF7EFD82A660D7EFC02B39B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755879, "uuid": "1e8be84b-c16e-4560-a01b-70141fa1c373", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755879, "uuid": "c9ed4671-a48c-475a-96b8-c732a57f8ba6", "value": "98304:oFE3b5baIQssAqHMHhmD/V2xsOpM07gM2VtG7U:oSb5uM/yMI/V2xf607gpnyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764755879, "uuid": "f3f387ac-a4e1-4b98-b44c-461284444af8", "value": 7374464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764755879, "uuid": "4020b5f3-d974-4014-9626-ba80ef0e08af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755879, "uuid": "e04ea818-0b51-4455-a2f8-5ce1179ae655", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495088fb-d0a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764805158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805158, "uuid": "c44dcdb1-d0d0-4284-9df2-452e4ae3ffe3", "comment": "Malware payload (Mirai)", "value": "2749f8985c4d99858798085bfec7fd32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805158, "uuid": "2cc6a92e-682b-4af6-9f7a-decc7e090c72", "comment": "Malware payload (Mirai)", "value": "534c84ed1b163e968f424eb4b3db38946258abdf2012f644875ef54889cca378", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805158, "uuid": "28df70a6-97e1-43a3-87e0-832a1b5ada3a", "comment": "Malware payload (Mirai)", "value": "c48219da27d6eedd19c33b1951d7a892217de9b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805158, "uuid": "eda92836-ffe6-4ccf-9c1f-e760ba363024", "comment": "Malware payload (Mirai)", "value": "775562dadffc6dfb64e07405646b4b1c5fa46feaafe8d5388f639bd0d02135f850a419de8603d29f71ad0b5d6f136df9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805158, "uuid": "1f1ca53b-5fb9-490d-9f29-24d0e310c68b", "value": "T1B1E3C50E6E359F7DFBA982344BB78E25964833D627D1C585D1ACEA011E3034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805158, "uuid": "d30c6ca0-a99e-4d1d-80c0-36e3263f3022", "value": "3072:3hjeVvmKYZNwwky05qRWfmheo09UqIF0QDXsFPuLCGvn5HJ85T5MfrN3h2XDgYvo:3cVvmKYZNwwky05qRWfmheo09UqIF0QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764805158, "uuid": "014d34dc-4c66-4060-b194-6b19a4d8e314", "value": 150132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764805158, "uuid": "4a11bc00-32ac-49fd-af0c-8f4ec18724b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805158, "uuid": "186cba9c-c9db-4ff7-b73d-1b306a7e9f8a", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae8c761-cffc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764734482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764734482, "uuid": "851214f7-15d3-40df-acca-c9945af1ff69", "comment": "Malware payload (Mirai)", "value": "6ebc5629b26e025d46220725bab6003b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764734482, "uuid": "faab6510-dcf3-45e7-ab3d-ef9bf77e1981", "comment": "Malware payload (Mirai)", "value": "5361ff34e16d804de3a03ad3cca828ddc82b632ec7c1a5ec4cd6aa7ebf1c9837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764734482, "uuid": "0bbc665a-5597-4e8d-80da-e70536227e9e", "comment": "Malware payload (Mirai)", "value": "d82127f7641039e62daa538d2929ad927d4b90e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764734482, "uuid": "da84f64f-062d-4d76-b48b-cff4857cc5a2", "comment": "Malware payload (Mirai)", "value": "dadf1b380743817e1438e97d442272238e90a4501c93eb3dec21f7bc1627c429ea689e447197ca55ebcec51067699116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764734482, "uuid": "45e5edb1-b1ac-4296-9da8-69a0ee43c616", "value": "T133935D22F975092BC4D4A47B22F74325F2F2478B24B89B1E7D710E8EFF2465026676B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764734482, "uuid": "e58e1170-66c2-4045-9b57-99d4d4583839", "value": "1536:u6KY/LeJYTRCDnQip0pY9Nth9qkctN6l95nD6tOx8:HwZp029Ntkr6lPDR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764734482, "uuid": "e55ab78b-a47d-4e41-96de-76c911857ad6", "value": 91808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764734482, "uuid": "6300ab3e-2f80-49b9-b0c4-3369302992a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764734482, "uuid": "7ab626c1-6ebd-4d2e-b112-0957c4c5b9b4", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd6bf17-cfff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735859, "uuid": "93603eb9-24cb-44d3-96f1-519ea33c45c6", "comment": "Malware payload (Mirai)", "value": "789df9f058c00e87e750b044480db4fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735859, "uuid": "0955509f-993c-4bb1-8725-57f01673da99", "comment": "Malware payload (Mirai)", "value": "538421686dce5c397070908efb6af799e32d3fdae2d137fb90dcc5078322fdd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735859, "uuid": "734e4219-318a-44b2-a80d-35248280754c", "comment": "Malware payload (Mirai)", "value": "cc548b50a5c75d938ab8da046def515cc8591915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735859, "uuid": "a9a41d1c-d636-4d9a-8da7-5ece11564ea1", "comment": "Malware payload (Mirai)", "value": "fbf6d1d1ecc721849d55cb704ab10e68aee670ea6cfc5fc161a58eae048830628add9532a6d6c267fe161b1bbdd87763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735859, "uuid": "255328db-1cfb-4d9f-826a-7004f03ebf84", "value": "T154736BC7A743D0F4EC5205313177B7326AB7E27E1158DE83C7A9E932AC12642E25A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735859, "uuid": "25f3b752-2813-4452-9fec-a00882c5a157", "value": "1536:5UK7LFzyfPNSg3qQ/qkjV3YUlM5McWeBu98lo2abSzP9BL:5l7xENSg3z/z+TMc9UGO2RzP9BL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735859, "uuid": "e2d9dfcb-b0e4-4914-821c-fccb58e51637", "value": 75248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735859, "uuid": "ae25bc7a-1e15-4421-9291-09bd448e0bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735859, "uuid": "c189620d-8262-434e-8717-bbb35b161d48", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f0b732-d06a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764781522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781522, "uuid": "8bc1712d-01b8-4331-8799-d4a37a3b464b", "comment": "Malware payload (Mirai)", "value": "b489518b80b01897fcc185478053ff3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781522, "uuid": "bf7254f9-0615-44f4-b0c1-b25fcf529987", "comment": "Malware payload (Mirai)", "value": "53d5bfedbe9335244088648533751e5260a82bb8359a8cd7540a76b9e880990d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781522, "uuid": "fbc650f4-154b-4c67-9dd4-30abf38f240f", "comment": "Malware payload (Mirai)", "value": "6d89337c9fb97d43e561d9a452109b5d33b60e48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781522, "uuid": "5f659933-4b70-47a7-8833-2e5b778aa346", "comment": "Malware payload (Mirai)", "value": "d9c46fcd884fdfe5ad10dede3ea0f19c751d4802bf2520c119281dd7a02593e67067b3563fdf6a2fe8ce34e252887e6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781522, "uuid": "641ae0e3-dc52-48a4-8c46-b823d9b91c18", "value": "T1C3B3BF75D0A51CE1C190863460F1AE3E93A3F414A71B1FF26958C7AE644BDECB25B3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781522, "uuid": "0682ba10-6768-484a-808c-7afee7242554", "value": "1536:uEa3vwc/BLq+Q0ZDf2DBLWudjyl2zqWdWZHxFlK9chugxc7cCKRuQEdT1T:fgwc/Y0ZDf29LdjVhWZHx29yxc7c6LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764781522, "uuid": "456ac93e-2dc7-4258-b59f-cb11eb3ba591", "value": 116308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764781522, "uuid": "795dae2c-593d-46ea-bf4e-40f23a056d32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781522, "uuid": "bfcc7ef5-2630-4739-9e91-bb2bd579ee01", "value": "Yboats.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d192e9-d047-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764766800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766800, "uuid": "5fbe3160-12ac-4223-abea-9fe9c260e692", "comment": "Malware payload (Mirai)", "value": "67d19c3af185d1338adcce8e46ab9caa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766800, "uuid": "d1d34c29-ecbe-4529-b064-89db102c4019", "comment": "Malware payload (Mirai)", "value": "547d1e75421bbbfe0492e2191417ad070d3e1e40db837e9aa4737c7946cd67b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766800, "uuid": "ba7f50dd-0e76-42c8-bb61-fbb7d83370d5", "comment": "Malware payload (Mirai)", "value": "5d40c8581ff8fc3bce110e897db72de8ccf1a6a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766800, "uuid": "537c65e4-da4f-4a94-8abe-2a6e836165e4", "comment": "Malware payload (Mirai)", "value": "005351b281c3d0df25883a3d85b1de966cad32b2535f89005c3c6ca56690a2d8ba5e490ce931941b6cddc142d0b7fa42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766800, "uuid": "c69c3fee-f526-4f89-a548-52d79f0a9d8a", "value": "T180C3F659F8819B21D5D622BEFA4F529D332317ACE3EE7213DD145B2437CA91B0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766800, "uuid": "b47dde31-8e55-46fa-8f2e-4b6b8b617d9e", "value": "3072:vaBG7tetktS4kdzRmXm4OYaShA9ZT0+a49hqw32qBNO8S7wczn5Q:SBG7tetktS4kdlmXvOYibo+a49hqw3xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764766800, "uuid": "7bfaa6d9-7d8a-48bf-81db-4c96c3a260cb", "value": 127704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764766800, "uuid": "c25e643c-942a-49f4-8f52-20cd2335e362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766800, "uuid": "0aa112b5-e7ee-468f-a0bf-6cef01f4a4f0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3909b9f-d041-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764764185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764185, "uuid": "13d643e1-7a31-40a8-bbde-f81adf3ddb32", "comment": "Malware payload", "value": "267f3761fda9302271a15f58489496dc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764185, "uuid": "14c0981e-3943-4bd4-8f51-26278322e1ab", "comment": "Malware payload", "value": "5489860f76b4067a37ab24147f75035ee1a6cbdc0e22568205f975dc12d44a19", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764185, "uuid": "df814f6e-fb4b-4964-909d-cd6463c49b2c", "comment": "Malware payload", "value": "e2e5d02e3cd6785561511574531aef9223db7f67", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764185, "uuid": "f6a6ea6f-8643-4be3-bd50-955a49a5d607", "comment": "Malware payload", "value": "f55b98a84b02b34cd19e67a90169375298259a63a58fed8b8478543ba4c24d168b8d394e302f7d0fd78508a45c9f1e2b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764185, "uuid": "8622be86-3512-440b-b657-f30028aaf88a", "value": "T17EF2BF0AF60167A0CED4DA6164355E0A3774D1DF670BA78DB023944B7F6F50BCA6A0F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764185, "uuid": "53dfe779-0134-4977-ac54-c549d713fbf3", "value": "768:H0dH5Ek/S0bk3aDyBE4+75AdCJVfrQbYxC7BYVUpni/I1DREzdu0nsixz:H0dH5TLWYUE4k5A2VfrQbEcB6QoIBO9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764185, "uuid": "c4c637dc-ea80-4c6c-82fd-c5084058e3ad", "value": 36134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764185, "uuid": "132419f1-41ee-4691-97d4-83080d633ba5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764185, "uuid": "98738714-679c-45b1-ac87-d6e803a5775d", "value": "voicemessage_expir.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1283b7-d067-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764780411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764780411, "uuid": "3e975b21-decf-4c24-8583-d8a9046211a7", "comment": "Malware payload (Mirai)", "value": "bd73a31552a199b1ed4ef0ec3f228487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764780411, "uuid": "21d40a84-48b9-469c-aab7-2ba9d9451890", "comment": "Malware payload (Mirai)", "value": "551d4e941a5e0687c830d3d62b342f58081d9da51bbb1e0bdaac84b22afa9349", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764780411, "uuid": "08ec2429-e325-414a-8092-eca809e2d2f1", "comment": "Malware payload (Mirai)", "value": "f94ce52e70a96b3935b36aaab9a11c569c9dcee4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764780411, "uuid": "482a2ce6-d85b-40ac-bdbe-0c164b195841", "comment": "Malware payload (Mirai)", "value": "0e4d2d4aad303df1bf50cf6bcb8584f56e1b180ed7fc646ed1911c2dc62117cc9654f97467d77570d0a8c7289de2e054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764780411, "uuid": "a34c3dda-e0c5-4343-aab0-e02b5e052b3b", "value": "T1C813F186A3C49AACF89844F2DE0FEF0B4640921D70AF62B2EBD8753A2D5F70435B5C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764780411, "uuid": "ecb97407-dfad-4ba9-87aa-6983e83c6d5d", "value": "768:1Hdk0jZ6NStnLnAkIDpZZBSTZvn++hLh3EgdXnbcuyD7UVyqQ:tdk4y8Ak4Z36Zvn++H37nouy8sqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764780411, "uuid": "e6fc92c3-4e9e-4b14-b93c-56867521b6b0", "value": 43444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764780411, "uuid": "825621a6-5e5d-460c-a133-8ec471059095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764780411, "uuid": "d5f7cdc4-512c-4973-a5c6-3bef6f41d261", "value": "Yboats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763632c0-d008-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739521, "uuid": "bcf2f420-d5b0-4c31-b84b-a1e736df24cb", "comment": "Malware payload (Mirai)", "value": "79b505acf2b61c7930586f6568dff98f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739521, "uuid": "9f8beae0-a02a-483c-8da5-fec4a09518f5", "comment": "Malware payload (Mirai)", "value": "56a6ffe384ad25768563f650da5077750468dabbfe1ba341db4ca3f6390df8ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739521, "uuid": "a7cd4072-994b-4822-888a-26774fa4713c", "comment": "Malware payload (Mirai)", "value": "c19225a0769cf83a6dcea413b28b14486d47672b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739521, "uuid": "7a3c1691-7095-4e87-a088-198eca8808fe", "comment": "Malware payload (Mirai)", "value": "43e9a8ec4439f553672bcbf76eb4cbd8636bbd0301758b9220e0260084a3daf96a219da89b8c01979d833c1117c10765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739521, "uuid": "ac630a41-f113-49a3-9644-a22652a2b2c2", "value": "T19E349DB2D8369DECC2148571B5F0DF391B139441419B1EF6AAE3CA249087E9EF2287F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739521, "uuid": "cf978063-defc-4533-a07c-6734ccccf91c", "value": "6144:aUhZ6oIlHpytyys+6kGjuW8PfW4C5SJgK:aUTPIlHpytyNuW8PlC5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739521, "uuid": "94bf9063-168b-418f-8900-31ec03e02b9c", "value": 232416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739521, "uuid": "2c0a73f4-75e7-4557-9dc0-f04c98d89719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739521, "uuid": "07111235-919b-4127-b5a5-d4e9350dd7bf", "value": "ecco.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86178366-d046-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764766176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766176, "uuid": "3476c51a-ee5b-4ce3-8fc3-76f5ea59440b", "comment": "Malware payload (AgentTesla)", "value": "55f856126ea739ad5b1946fc4bab8de6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766176, "uuid": "a90cafe9-e3b0-41cc-99ce-d1667a723bc5", "comment": "Malware payload (AgentTesla)", "value": "574480a151bc4f07e68de202fb516ecd1a34599939073e3d63bc7056e818bcf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766176, "uuid": "543f8478-bc01-43a0-9f96-96312b0310ac", "comment": "Malware payload (AgentTesla)", "value": "b4cf3037dd53cc7c84e3ca22efc7095e4407b27a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766176, "uuid": "9453a409-5008-456e-9e13-adfe286a3728", "comment": "Malware payload (AgentTesla)", "value": "0aeabc750eff220378e95e676f88fad754d30a55bee62ea6d7bf1292a352ad35baa461da152c5f73ea50c5b7b6573e27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766176, "uuid": "286781bf-4bf3-44c3-b031-7fe1965cf01d", "value": "T179A42354F13C50234A318A0993BAD21A1DA774DD809F3998FF859C5E9C9ACF8E1D87EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766176, "uuid": "251a611c-a54f-436e-9577-ab9d762f8f76", "value": "6144:DWsaq3xHF8SMIDX8bKltQKeEi+zUtT5QDT+LMYlb3RW1kIpjiIqyxX4WfuNUTAI:6sf588SKeEi+oxmDqRRW1XQmXWyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764766176, "uuid": "77784092-adfc-4aed-b23e-c7529130d0eb", "value": 457726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764766176, "uuid": "8822cf48-ab4e-438a-8021-848beb112133", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766176, "uuid": "fd9d8cc1-7e7d-4b69-bc0f-d102d9489339", "value": "FreeTempSpoofer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20e6946-d056-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764773229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764773229, "uuid": "af5a7216-8bd6-499f-a016-c6c777936b45", "comment": "Malware payload (Vidar)", "value": "b3ed12f0658946868c1007db56ebe4a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764773229, "uuid": "9749dd08-fcc3-4e95-a964-8675cd3b8f21", "comment": "Malware payload (Vidar)", "value": "5764ca651cf197bab1b99109705d19d43644574b3a7946fc4e7464978a4701fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764773229, "uuid": "55f0a3b0-21d9-49c8-b1d4-456a1c3931a7", "comment": "Malware payload (Vidar)", "value": "af021c16fba5b1867613a5326ed18a80818f29a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764773229, "uuid": "44e639bf-29c0-41d5-8c36-496642182ffa", "comment": "Malware payload (Vidar)", "value": "c9c9f2526f768a3593a8a4d5286779eba367cf5eee10c474163d944953f3fb07c3ebd49bbb588a64783cae0eaf7a0404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764773229, "uuid": "71377882-b191-4429-80b5-587b4259f412", "value": "T1C0D53397A2D1D837E06D5B359AF201DB14337EB0B6106B8731997D0B9C72B20E93A39D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764773229, "uuid": "d3c57b15-a191-481c-b6aa-2293b8f48d8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764773229, "uuid": "e79af566-22e0-41e3-899b-44a9f9b7d7cc", "value": "49152:+Fk+cAZke8gdfNrWYJCJkMAupqJXo4zxHdyWoDQq+jK1pOTf6PsvPMvw:R+cA8WfNKYJCJkMCn9yn+jK3OTC0Hew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764773229, "uuid": "c857ca65-d93c-4ecc-8da3-1a01e52d4e54", "value": 2900880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764773229, "uuid": "d7fe9d90-bac4-4329-9ff7-9362ae830b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764773229, "uuid": "25e64b7d-f09b-4c0c-aca9-646682c64080", "value": "Aura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f0fd86-d03d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764762329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762329, "uuid": "dc203dca-7c7a-469a-89b3-26197ad351e4", "comment": "Malware payload", "value": "2a9b42d9c8840e6c7e0c37edd5efab91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "users-freenet-am", "colour": "#B551EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762329, "uuid": "795d57db-4577-41d6-ab2c-5f581cb8218a", "comment": "Malware payload", "value": "57a25d5e5dc599fa214672d18d0a99eb9966c6cac4929b5fd08b1055ae3a5822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "users-freenet-am", "colour": "#B551EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762329, "uuid": "9cade366-07b4-4382-9214-bb8944aa7ef6", "comment": "Malware payload", "value": "15327f0b459bd8d0fdcf0238ae70ae14a86d44fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "users-freenet-am", "colour": "#B551EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762329, "uuid": "c35076e8-1aab-4010-9a95-4a53489274f4", "comment": "Malware payload", "value": "eb2439bda8757a9b5edb01b32108c923735a540796216ab489e18841cf8ede595d9e9b24f4e7dbc8a0aed62ad4ab6da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "users-freenet-am", "colour": "#B551EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762329, "uuid": "49880c6a-ed96-4061-8b2a-301061fec875", "value": "T107B533AE4916542FFF5CF4396487EC7D41B3328178993166A07C893ACAA7849CC7BC9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762329, "uuid": "ffbaa1f6-d67e-4626-a544-636b94cfeaf4", "value": "8b21ff8a0d0059e9d67b568f049de051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762329, "uuid": "002222ea-4353-4de9-bf72-b7a581c43c93", "value": "49152:o1yT7V4AuEiwjrLmq+O1GjvITrN/Rji+nBUn5dSsFp5g7ms5vmtqDuhUxEc+L:o1yTGmiwj93t7jiOBUn5dSW58jYtAVEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764762329, "uuid": "1d58e0d6-f71b-4820-9df5-413ab5156330", "value": 2407687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764762329, "uuid": "87b1ad17-5acb-44bd-9451-9fc354f77241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762329, "uuid": "f8cd75e0-4973-42fd-8df0-45eb78d19a16", "value": "12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b89030f-d099-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764801806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801806, "uuid": "3be8196f-8d8a-4c4d-bf3b-7a15f4757ede", "comment": "Malware payload (Mirai)", "value": "15a7526bc6eacbc3d568f0495fe62f85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801806, "uuid": "954e9089-472b-4489-ae51-53f3542e470b", "comment": "Malware payload (Mirai)", "value": "57b85033fc3c849f07dc2006fa0b87fd813f333c686de9864360ff246818ba72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801806, "uuid": "eab5217c-8c71-4328-81d1-d01852079eb8", "comment": "Malware payload (Mirai)", "value": "2caa8a3aed8d916358dde9c5dea77c7e4bb0b670", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801806, "uuid": "e9c4be3f-f50d-470a-b623-91013228dc74", "comment": "Malware payload (Mirai)", "value": "5fcaf6abc0901527f56c283a68cd67718fda06b450a7082373fb3b620270936c7d5fe3dfcb57d5982ce8de7c36c47dea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801806, "uuid": "61ec3fe2-49f0-41cf-8311-a4ac935f7b61", "value": "T114E3C609BF611EF7E89FCC3705E91B01288D691622A93F36B534D858B64B24F26E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801806, "uuid": "22efd4f6-6765-41cc-84fa-6e2a1b7ca3f1", "value": "3072:5SiLTdQUa2BSRcBIZaRmcbbc7pzrSQOfBQawSq:5SkTdQUa2BSRnZQPcJrShfzwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764801806, "uuid": "fa58c211-cb35-4973-8915-109184fb1383", "value": 157156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764801806, "uuid": "37f7df3c-aa98-4c62-90f3-76f4aeab0585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801806, "uuid": "1920828c-5da9-4f32-9e1c-1ca0be34a741", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a56e24-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767361, "uuid": "4e5f795c-65d9-4ac6-aacd-8dd6eaa8fcbf", "comment": "Malware payload (Mirai)", "value": "b676e7ce7c6eaa89bc08ea789761555e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767361, "uuid": "a70d4bf9-a50d-4167-a94f-76db9aff3e10", "comment": "Malware payload (Mirai)", "value": "57e6d1505961ff328bc000fd569b6dd478fefa10a21a16897eaa36d87aaa8126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767361, "uuid": "2fd7649b-d243-4e7c-96d9-a5815471147d", "comment": "Malware payload (Mirai)", "value": "b958350a7b14d1ec70e75e71e941bccb8ec20740", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767361, "uuid": "e12f0eb9-7e49-43b9-889e-45761188258e", "comment": "Malware payload (Mirai)", "value": "dbeb0fb1c67bedc143dc0dbc9b78bfc9b9f00774c63df145d7f20f6071a8764e28caead17e6eeebcebca4079695d0c63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767361, "uuid": "b6004d5e-bdbe-454f-a18b-3f80389c9285", "value": "T104F2F1798A05B4D4C36541BAFE49848AD6082738FA5AB0EF6F3047246652E77EE724C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767361, "uuid": "f912cd39-a5a5-4e8e-9667-9a2ad2dfd2c2", "value": "768:RKiQ47RQwmm8Tie1kk2GgVNwm3t/GSP4dRf3g19q3UEL6iY:xx70mnu2Ggbwm3w/dRfzLZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767361, "uuid": "e1913418-54ba-4608-bebc-6ecc0271b41d", "value": 37240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767361, "uuid": "385eb916-1398-43de-86f0-4b354676aa2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767361, "uuid": "c2e69ee1-46dd-4942-a21a-05d3ed80bf05", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed12deb-d099-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764801624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801624, "uuid": "9c5e8edd-14a1-4314-b629-1e349e8c9474", "comment": "Malware payload (Mirai)", "value": "c56b84a2f8b5317203262c138ad311c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801624, "uuid": "4fd6cd81-e92c-43c2-9932-bc8dc43d1d3e", "comment": "Malware payload (Mirai)", "value": "57faeb07f191524e8a4f5a07571e246e2a202cefef04932a252385e6faa8958c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801624, "uuid": "9935c740-f5e4-460c-969a-33e8f5036163", "comment": "Malware payload (Mirai)", "value": "0a9d0c22cdddf9d96ba8060ef196c4838be597ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801624, "uuid": "dede1725-b885-4835-97f2-7640797f41ab", "comment": "Malware payload (Mirai)", "value": "5c61007885005f841059b9b4c1732d33a519464b3996dc7944c0267f33fcedb424023152ace2cd1f5890d54d59b76f32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801624, "uuid": "de324c4f-0c8d-48ae-b254-3a927ab9cc9f", "value": "T12413028740E29BA8F26814F3357D12450924529CFE2190E7DEFC523D844BB7C6FACAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801624, "uuid": "052ccc82-f0ac-4817-ae9c-260f166c2bbe", "value": "768:x2fjRR9ZCUV7msZnr0/77xyg0m4tvaoSQfrLzg+A/22m8KYyVXRdNHcqBY6Dnbc+:+RLZCEm20TdsdfrLs+A+z8VEhdNCYno+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764801624, "uuid": "457fdafd-28c9-4a6e-bda2-d62929835635", "value": 44708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764801624, "uuid": "4ac55482-c807-4755-b67d-f1339105b140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801624, "uuid": "87307df3-c280-4a53-9c7e-77d22b20e6ac", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24399be-d04e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764769793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769793, "uuid": "423d1433-a187-40c0-b900-1738d230629d", "comment": "Malware payload (AgentTesla)", "value": "6d45d104a804872df43b183856d60a54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769793, "uuid": "f79c9a0a-ecbf-4e92-ae48-96fb97251e42", "comment": "Malware payload (AgentTesla)", "value": "5834faf19f1b7bb34f25999d86cac6664ae8f5c578c32eef0ca5fa894ab152d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769793, "uuid": "64059369-bfbf-48e3-b7c8-58f4e73ffc6a", "comment": "Malware payload (AgentTesla)", "value": "d76a3d5da74e8de5f65aaa42c7de212775812cd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769793, "uuid": "6ccca6ca-d406-4230-a900-c6ee019a3c45", "comment": "Malware payload (AgentTesla)", "value": "a903f0a02d31a42df6fdecdd3f53295c245eab894ae1c03993487c24603e3a389ec891d9fd9ccb581725c21bacfbdf39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769793, "uuid": "2cf70631-73d1-44ea-911b-1228a9b921e9", "value": "T12CB423C4D296D42669C115F660A4BDD06CB90EF83C661E37AB2D4016FFE0D2B7B1D0E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769793, "uuid": "58c1b5d7-e0a8-4804-bc01-be8c81166249", "value": "12288:S2sC/bMXw1egDPvN8Oc3oJekehg+Jac8no6C3hCS:PR4X10SOc3oJekehguac8ZQIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769793, "uuid": "3574c122-920a-488e-ac36-81ab438deea5", "value": 521966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769793, "uuid": "805dff3a-58f0-45fd-b7fe-10c429c86997", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769793, "uuid": "afb172b7-d652-44e7-a702-77a8377b833e", "value": "FreeFortniteCheat.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503d7c15-d059-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764774246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774246, "uuid": "3b0f1246-b590-412c-a22b-b6dc626f445a", "comment": "Malware payload (Mirai)", "value": "d45edaf54777b4e7fcddf379e2f5bdd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774246, "uuid": "edae9146-4875-436f-9e9c-1918c44dfeee", "comment": "Malware payload (Mirai)", "value": "5875c8fcb2c4ff7551c1c29ee86abb5ab558a47cd2899e30ca19cddf96ffd919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774246, "uuid": "52b205c8-1f21-45b6-8ddf-a34402212c73", "comment": "Malware payload (Mirai)", "value": "e1e62889c26bc8da7762ef23b2890a5e279a329b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774246, "uuid": "2f74aee7-824b-4db3-905f-0385a5b129d5", "comment": "Malware payload (Mirai)", "value": "7b7a9a0c7aeef654138e94d28bf48644e698b086861d555538824d93567ef66ca4a724f4cc5b7260505e8e3371df65c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774246, "uuid": "53dd4327-d571-4778-b41c-764eb4718971", "value": "T17F836BD6AA53E4F1F81A027115B7E7338671E4362434FA83E764FE73BC62A81954638C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774246, "uuid": "60977479-bc34-4aaa-99ac-c2446723bc2b", "value": "1536:dvnrEn7d4u1g7iu5rVjD96CMa6EcIk7VNtuBYqgqbWHmWZ2rh8EIf:trEnKgutZ9JcVvuqqXyHcIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764774246, "uuid": "09b045a6-664a-4d8a-b7ad-c0a917864412", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764774246, "uuid": "fe382339-8f26-42cb-be11-54015834e839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774246, "uuid": "5739b1fb-9230-4da7-9889-387f36e4783c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d150de11-d099-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764801950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801950, "uuid": "877087cd-9812-4140-83df-25c5ce27a567", "comment": "Malware payload (Mirai)", "value": "fd50144b7a4e5034153022f48d67ff5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801950, "uuid": "9f1067e0-5e3c-4d17-9c20-a414a57543cd", "comment": "Malware payload (Mirai)", "value": "58ef66b5ce06fc7678e16c07687ec3e99287a82441a8e3b1c3583c572726a617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801950, "uuid": "389a0fb0-c6e8-4ed8-8a02-35793bde739a", "comment": "Malware payload (Mirai)", "value": "ed6c07438b9309451d36a9c50dd9c2a09e997f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801950, "uuid": "1da8acfa-1ded-4074-a7e9-2b938962de45", "comment": "Malware payload (Mirai)", "value": "8bc084869f440f2af0532c66da307f4ff2ce158eccd99665db9243b13670d45b01d3e3b295b68c71a5d0a06e914c5d04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801950, "uuid": "daf83aee-10ed-4af4-a8d7-82a81383c78b", "value": "T170D3BE97F74314E1C85347F407CB4B9E3E6322825F6B99E7AC6F653A687A0DB0502B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801950, "uuid": "0353d9b7-ec8b-4368-9e52-2f581647c634", "value": "3072:9zpglPD/mNjL8jtDEWrLsH4ZvaDGgYxq:N+PiNsaWrYrMxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764801950, "uuid": "0e0534f2-184e-421f-ad21-279e011c8c8c", "value": 140936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764801950, "uuid": "5497678a-2f5b-4f4b-ac8a-4d2ab1110bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801950, "uuid": "5a526a5c-6fbc-4b19-a020-a528fbc3c456", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e70006-d013-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764744412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744412, "uuid": "253b2419-77c3-4f81-8bac-71c1055a4d20", "comment": "Malware payload (Mirai)", "value": "efc48d73b442b845848ff5ea13d5afb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744412, "uuid": "9f2236af-4c37-4f67-9920-1c1c09eec6d2", "comment": "Malware payload (Mirai)", "value": "59e766e326af24d2b037c7f57c014ee7f824e98b44a4b7de67ae12358d115e79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744412, "uuid": "d151a6d4-cd01-433a-8725-b628983ca6ab", "comment": "Malware payload (Mirai)", "value": "88a839f82d6f109b4b029a6d5fb3ef801f9fc91d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744412, "uuid": "84a19503-94b6-4322-bb43-22615d77d6fc", "comment": "Malware payload (Mirai)", "value": "22378eaffb9237e8f0b17e1a21bcf5c375b542824289e9b0973803c7b9b8ded22c6134247ecbf31620adade5f2be1b23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744412, "uuid": "da92cc6e-0f54-4389-a850-eb1c9f73fd67", "value": "T137E2E09412FB5C9BC6E40D39B378018B326703FDE0B664A957A2C5817DDBE6891F90CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744412, "uuid": "758b683e-7df3-4864-8c32-c8aacb4333bc", "value": "768:E6SWdOmMC+M5xyf/BSAkAVOIDu0qS9y9nBXS52osEps3Uozwy:E6d5gXtbVOajQZBX/os1zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764744412, "uuid": "4c8a9a2b-7b64-484e-af6e-47b65ae0b59b", "value": 33380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764744412, "uuid": "f63ee987-10b0-41e8-ae99-08103872facf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744412, "uuid": "c640cdd2-7a69-4820-9af7-7592952767b4", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12acf1ea-d07f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764790464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790464, "uuid": "b5fada26-683c-4675-855a-9a4c357b371c", "comment": "Malware payload", "value": "9302af396fca08f324a652b912879448", "object_relation": "md5", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ketelmeester-nl", "colour": "#1A9DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790464, "uuid": "a66cc819-f220-46d1-b16a-9ebd857d9373", "comment": "Malware payload", "value": "5a0899b365d1153a6ab2651a57e0b761eb1a401cd8e43e03461ea2bd3a1a536c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ketelmeester-nl", "colour": "#1A9DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790464, "uuid": "ee8bf255-4a20-4333-9c30-d0437961d93c", "comment": "Malware payload", "value": "72d82ae495ec63cc2830a391ec1f152e86777a45", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ketelmeester-nl", "colour": "#1A9DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790464, "uuid": "f6e0dc43-d92f-48b0-9f73-5de96d342a15", "comment": "Malware payload", "value": "789eb7b4e85db361246b27845802ec395959d181ec4952cdcbcad2600787596d43abd9151135f829ef3b8fefd51f79e7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ketelmeester-nl", "colour": "#1A9DE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790464, "uuid": "0b4807be-30e3-406f-8e62-2137579d3849", "value": "T1CEE6E7DB03FC23D840B1D37F9A187005A95A456E278A7AD43E0E7B14BE98C1385AFED5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790464, "uuid": "ba042884-12fc-4c79-934b-dceb9a65695b", "value": "4ba129d348e158e01e2b44bf24d2d5ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790464, "uuid": "2e7e9ad8-a4df-4241-a0e1-a97859a661ba", "value": "393216:eRZElYZRg682AJqHYX0HR98U4wcgkYf1uXlwlIZQ6jOOma+2x:eRZElYZRg682AJaYX0HR98U4wcgkYf12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790464, "uuid": "1d24cbce-bf28-4bc1-8509-7a24c1637bd1", "value": 14369792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790464, "uuid": "6f4a26dd-a36a-4afd-9479-435c966337c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790464, "uuid": "fa50cfa5-09ff-419a-9abb-49aca66f814a", "value": "tagspaces-win-x64-6.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bae49c-cfec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764727704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727704, "uuid": "53c39ef7-1b93-44ca-9fdf-719d25530b5a", "comment": "Malware payload (Mirai)", "value": "81d9040a8332a26f92f1058ff0a57424", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727704, "uuid": "beff5ce8-ffe8-4164-963f-2a23d0b9d567", "comment": "Malware payload (Mirai)", "value": "5adb2aa9ccc84b5ce41380e9b3eb292c9a277b075d4c28f26bd05118205489f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727704, "uuid": "481f8ced-70d7-4978-996f-cfd233f72e0d", "comment": "Malware payload (Mirai)", "value": "03fde9275cf0526ec9092875ef9f05428e352f9d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727704, "uuid": "f9f7f154-8761-4c68-afed-95d36747f186", "comment": "Malware payload (Mirai)", "value": "b68f66164a449c48414fd116bcd8bf4a151fa2cd8708ff01b76713a16178cd0187629aee21920ebdb0446e0dbad386b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727704, "uuid": "781e2435-537c-4625-8bbf-88730d112bc1", "value": "T1D0D0A7CE24912A408404986971761A3DA043D2C8258F0F6DDDBC953E8848948F009F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727704, "uuid": "47d17d41-35c9-4f79-8bc4-135d5aca857a", "value": "3:TKH4vGBwV6FnDjXQX4gHKvGBzSEyLTUWOIg6FujXQX4gHKLTBzSE8eUzKOfqFj6E:hD6FDjXQIgqeImIg6FaXQIgqfif5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727704, "uuid": "743c619f-5056-45af-aebc-fcd9c2ba61d4", "value": 213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727704, "uuid": "3f378800-1459-4251-b1e9-1177718dc717", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727704, "uuid": "ddf10262-83c7-486d-824a-89ea7c765e5f", "value": "lnksys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951c6f1e-d077-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764787246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787246, "uuid": "df4975c9-66e5-40e8-9c52-30a2b5b902ea", "comment": "Malware payload (Mirai)", "value": "50e91a944f3f85780f47a3f07d0257d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787246, "uuid": "ad4783c0-71a6-46a9-99ad-98ef2ec7f64f", "comment": "Malware payload (Mirai)", "value": "5be89d44af9016a797a2329766e21c6635bc02cfd8e6c5df4056c36138dd1d90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787246, "uuid": "ed2cf8bb-af91-45a3-9576-2de16ff1b4a9", "comment": "Malware payload (Mirai)", "value": "9ea6734e2fac91d46abe5919c2d117ca79f1cec2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787246, "uuid": "0b035695-997f-4a96-a967-3381b80aa3da", "comment": "Malware payload (Mirai)", "value": "09a20287e8819e1928a557949a929e5f12764aff42a5b2617f19d3a838b1a0be66c7f8d13af54a680533b98f6d5cb207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787246, "uuid": "47351ab9-0ee5-4998-bccd-28b85acaf8e8", "value": "T1E463F786BC918A9655C423BBBA7D81CE331337B8D2DF7103DD151F18B6CA84F0E6A952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787246, "uuid": "effc5c63-60dd-4393-b5ff-9eb98f262171", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913DhrPDysX+4if3LEVc:T2s/ITo7WCkybotgsJ913DhrbW4UY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764787246, "uuid": "b4ba0512-27a2-449f-a208-b449467b2686", "value": 69504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764787246, "uuid": "55661335-745c-482d-98ae-830a2644c624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787246, "uuid": "2ae29d9e-159b-4c03-a484-f9cea3f3ced0", "value": "SecuriteInfo.com.Linux.Mirai.4873.25633.9266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cfa149-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793797, "uuid": "abd5eb3d-30e5-410e-a07d-6d2d475e5a35", "comment": "Malware payload (Mirai)", "value": "9a6bc291f885c75c412a9f99e0101b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793797, "uuid": "bb835eab-7ca8-4078-a148-1d7d505a55cc", "comment": "Malware payload (Mirai)", "value": "5c96edcd514733da92b19c23a0f6ec4f99532dae7d9dc7fc134746b01431eebd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793797, "uuid": "c1e70056-63c5-4fa0-95f4-eb13ef1d3398", "comment": "Malware payload (Mirai)", "value": "1fe39bb340b41a860e02f2ec6f5c6572841d2c2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793797, "uuid": "12ba9cca-fc4b-4cc8-9c9a-2e46037f0689", "comment": "Malware payload (Mirai)", "value": "3605f855627e0beef86758d26a168b4e3cb47e79ba473234058763f8f53ea3253ae7b71037ac33b0d829f87dea9f29f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793797, "uuid": "fae9ffdb-1064-40d4-829f-25caad1045fe", "value": "T150C3BED7F68B2891C82247F407C76BCD2A6361018E6BD9EB6C1FA67F19390DB19127C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793797, "uuid": "2dfea6c7-5c6f-4394-b2fe-fe9e7621b077", "value": "1536:C30kTqrIbJZVcq7F7luuHNua7ma4V6/fdtsSk4ItCWxZJw7gYL/LWk:C30kSQVtu8NumddfdQ4ItCV7gYLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793797, "uuid": "161e544b-cb25-4877-9274-f34e4cac2349", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793797, "uuid": "80b61b89-ba09-492b-9683-0f13e1cda9c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793797, "uuid": "1068e09e-23d3-42ab-acee-9b4fb9a12734", "value": "zerobotv9.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ce933f-d090-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764797795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797795, "uuid": "4d355399-8bdd-473c-a08a-d298650df4e8", "comment": "Malware payload (Mirai)", "value": "ec67982d3da7d1e5e204c4c8b0b17d52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797795, "uuid": "b7dc94b3-4947-4afb-a486-a05cd5233c3a", "comment": "Malware payload (Mirai)", "value": "5d34a8c23f7063491aad8d151dd50a5647d2fdff062f7a0f60b4abe6c1a2d04f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797795, "uuid": "1ba038ea-3691-477b-8ca0-fcb8c03ae814", "comment": "Malware payload (Mirai)", "value": "073c441c810afe4ede6463378e5229f8b4073fbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797795, "uuid": "4925edfb-13d6-4396-9cdf-c2699eaf9675", "comment": "Malware payload (Mirai)", "value": "813f2df84c1aca75b4bd01eb60e2e21333e84154640d7a06d07904a349a4dd5e30f2eaa90dcedcd27fd0718442bc44ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797795, "uuid": "aa53769c-df97-40b9-ad0a-6f3cc3393107", "value": "T198E2E170B2A3ED91C8280C76B7FEC08726AB47BD64F83977B1190560E1893927DFC54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797795, "uuid": "e00b2585-85a2-4504-a80e-2a1cefdd89bd", "value": "768:ZIsfZ9QpJvJi4IcYvjryerYcDhJ+tls3UozQ:aszWvJwvfyerxDhJ+tozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764797795, "uuid": "d133e3fb-6957-4b99-8e3f-275a1b339141", "value": 33224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764797795, "uuid": "ca89cc4a-edf6-436b-929b-ed8cbbcf942b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797795, "uuid": "34685e65-c938-49d5-8681-715496ecce26", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ed468a-d01b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764747660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747660, "uuid": "0e1cb5e8-2b4d-42e9-b4ff-1c9422e7bc3f", "comment": "Malware payload (Mirai)", "value": "0c9d31badc240f3ed1123523974deb83", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747660, "uuid": "0a97f39e-c249-418e-9f6a-725f4b2aecdc", "comment": "Malware payload (Mirai)", "value": "5d526cd9fd62c839bdff20cab24c804f2f35ad47d62c11564a494447c59e906f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747660, "uuid": "20a3b70a-b8d9-4ca6-a751-0ff38bee4af6", "comment": "Malware payload (Mirai)", "value": "2e5133cd20dffcc9582db47996fcb9c65349e6ba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747660, "uuid": "8203225c-0ffa-448b-9584-2d380ae39809", "comment": "Malware payload (Mirai)", "value": "5b1ba1ce3ccfc62c26f256d7fb1da5a1e1d76470a38aa5c00632ffb2177fa13f34d7a7b5023e62011b0b5a7a4c53efb4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747660, "uuid": "fcaa59c1-14c8-474d-a41c-a4cda401ada8", "value": "T1535150CB01CE97F0DDA5599671F948047C82F697A4C3DE43E9B824A94C8ED80B1D0F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747660, "uuid": "5bf628bc-b376-401f-a90e-4a964ce1c03f", "value": "12:q0F2ZkNPDFKX0F2wkB7DFKX0F2oiko4fDFKX0F2RktDFKX0F2QLkQ2hVDDFKX0Fg:vXUxtUOvYhr7q8a2zV7INIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747660, "uuid": "45d30cad-5fc4-4032-8e1d-fe51b233af38", "value": 2737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747660, "uuid": "c32fe6b8-4979-4efc-939b-367bba16df6d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747660, "uuid": "3e26f874-7233-41c4-bb53-328992820673", "value": "goahead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1056ac-d071-11f0-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1764784812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784812, "uuid": "f1deb782-8b6b-4715-8f26-e114ddd00405", "comment": "Malware payload (XoriumStealer)", "value": "f3b08940d53495843b9ff6db3c11367a", "object_relation": "md5", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784812, "uuid": "7de3b2a6-8092-4de4-89ad-737d017efb92", "comment": "Malware payload (XoriumStealer)", "value": "5d8920257c318caee990816b951125fc8d641e3b7ec762b95fec4431e37a9386", "object_relation": "sha256", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784812, "uuid": "c4c9dbe2-2c9e-4c34-a62a-e9c7e043935c", "comment": "Malware payload (XoriumStealer)", "value": "7cbbbc658c684d646cecd0ea3440af1b9f35d849", "object_relation": "sha1", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784812, "uuid": "9c4755a6-71ca-45ba-a721-e14e4ebbd05a", "comment": "Malware payload (XoriumStealer)", "value": "ca0b3ea676cbc71db112722fe099eb24c1a1559921635472c9d7a6ba5e231e9c0b577164ff3bf2e4c80ef7a501573fa3", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784812, "uuid": "432b1b2f-f36f-406c-ad19-e44aa18fb136", "value": "T15E965CE336D2BA8DC157C47AC312F93F874FB876061AF693918462E6D92BC84B518F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784812, "uuid": "34bb5a27-96e4-4eef-9791-eefcce58dc54", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784812, "uuid": "ded8a238-f6b0-48f8-a1e6-684387a52d17", "value": "98304:PMcSUsKZFxOC5LRsMaHrFKRrW3xDOqYMcmv2pdlmaxEulGZJjCpgHyI:11sKROCRxaZKFmtcmvadlma+sGZlCOSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784812, "uuid": "c65ef868-5790-4701-a820-6f7b42f09ed6", "value": 8821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784812, "uuid": "bb608bca-f62d-4733-9ced-d32345cf1adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784812, "uuid": "005fb815-315d-4c29-8fcf-6faf00b70abe", "value": "5d8920257c318caee990816b951125fc8d641e3b7ec762b95fec4431e37a9386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb7fa1d-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736394, "uuid": "7102c9a0-33c6-4485-8ef2-b388bc715a2c", "comment": "Malware payload (Mirai)", "value": "ce363f86a78a42c839dedd265df7820b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736394, "uuid": "9601e2a6-cdad-45dd-affe-3d84342d5c57", "comment": "Malware payload (Mirai)", "value": "5db5d3cce9c53abef06fa130554c2f5de5729021bcf1b5af66d9d64cbc8d91be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736394, "uuid": "f473835f-f3d1-4b24-8444-8a91aa391f81", "comment": "Malware payload (Mirai)", "value": "9ed4e3bfcbcd877b0f6db85e678464d7d92f1a5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736394, "uuid": "d19f880d-e8a0-462f-baa4-fd1937a1da32", "comment": "Malware payload (Mirai)", "value": "ca291a39a44d41a19a9288939c2ee0677ce581c9a408fb15a2f9adc3125e3a3875bf782d6293ba2d61dc29904b696a7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736394, "uuid": "ca6b456c-ff91-42a6-bbbd-007ce98748e5", "value": "T1585302E51585D132DB0266BBC4F148CD91BC6EB8D2EB21273A984E10D3B9D4D6D4B7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736394, "uuid": "48a94818-3e1f-4bce-8bb6-fd9a58716425", "value": "1536:YIT7rFbCbYReBc41JshHxKNLIPgJ8G8YFMyf:YG7rpCMF41J0INLkKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736394, "uuid": "6fd61405-07fe-4853-a009-8aec208bc65b", "value": 64064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736394, "uuid": "413ac7a3-bfe2-46ed-9626-7b498b512387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736394, "uuid": "5e23999a-2a56-483b-98f1-e3490eebafae", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc923e25-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1764770589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770589, "uuid": "77e4a8a8-5902-4e74-a6a1-f74fc9f374cc", "comment": "Malware payload (DBatLoader)", "value": "b0ea29c1cf661822df1f052da920e61d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770589, "uuid": "d26a9e3d-767d-4b9f-987a-c6862d3354b5", "comment": "Malware payload (DBatLoader)", "value": "5e719da07984247b6964dddba2926767e599d4dd45c1e4805b18937afcceeda3", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770589, "uuid": "b5557b0c-39b6-44be-9aaf-c5492601998f", "comment": "Malware payload (DBatLoader)", "value": "bededd35a30470d41ad19e53f2b913178cff4bef", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770589, "uuid": "4f3a1907-2772-4fe4-a519-2cb552936718", "comment": "Malware payload (DBatLoader)", "value": "ceff50e298bf78a72810af0e817c98d9198202df99eb31fff71f641397a353b6853f07a2ea96b464565da07f3c394e56", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770589, "uuid": "5997fa33-8850-41b6-8c97-1a2bf7ddc3db", "value": "T13675F066A1F08436E163DDF58C1A938A542DBEB03F75A85637DC3F588F3623468261B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770589, "uuid": "80e001fe-ebc5-410a-81f8-7bfbd9f367d8", "value": "eb41e5567017c33839f07ebe2eb84cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770589, "uuid": "ad352676-6a1a-44e7-aa14-7e3a29d6abb1", "value": "24576:sbCbz7++IfUFixpw0QB7FqyJQ5Yk7Vdj1pVo4sH2DdIUPGMA4xWOPq9H:sbiFjbPqyJt4fJpVoJoxFxZaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770589, "uuid": "29f47e62-3625-497d-8bf8-17431019e2d3", "value": 1644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770589, "uuid": "81690f2f-365a-4e5d-a314-1c32ced4a3f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770589, "uuid": "ca997cef-6d97-412d-ba23-34d8ade72785", "value": "b0ea29c1cf661822df1f052da920e61d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640613d8-d07d-11f0-a129-42010a9c0007", "comment": "Malware payload (AURAStealer)", "timestamp": 1764789741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789741, "uuid": "95e66240-5814-4929-b29f-7a1d7d8902bd", "comment": "Malware payload (AURAStealer)", "value": "5cf21cfe152c06abefb2138dce81bc0f", "object_relation": "md5", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789741, "uuid": "4a72212f-8633-4280-bf8d-be4744e499dc", "comment": "Malware payload (AURAStealer)", "value": "5f43b0ad8cdf49434c552629330efc2e02e9f10444200cec44cc81b061e25398", "object_relation": "sha256", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789741, "uuid": "6f855258-9165-470a-b952-7b3263413818", "comment": "Malware payload (AURAStealer)", "value": "b18aa2292d649e6df5e212249959b6e0328d0fe8", "object_relation": "sha1", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789741, "uuid": "890a6ec7-5f77-4ac7-ab71-83250db24930", "comment": "Malware payload (AURAStealer)", "value": "b6b76e070e648aaa8f368a36794df21441edbe86cbbcc75c62f462d19bc0a450234563d3f2dcc20340c336ccb9ec5d84", "object_relation": "sha3-384", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789741, "uuid": "78e9645e-840c-41f9-99fc-8ab55a678693", "value": "T1BCB67B10A8C86607FD7ADFBC999E72500F7A71962541BB288F5209DD3ED1B68C8139F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789741, "uuid": "ea8b9830-0895-48c3-b2eb-028854c9f425", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789741, "uuid": "54ac0e54-6dd3-4fa8-8a3c-566404b1d610", "value": "196608:np+G61XpghtjVLRUwuBLYJcynZvOrJNX6h3x:k1aVLRUwuNYrGvXyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789741, "uuid": "43682202-dcb7-4c81-be4e-291dc211643e", "value": 10519552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789741, "uuid": "4a1299d9-6d20-490a-aed1-445d9db07b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789741, "uuid": "bb3cf71b-c933-4abf-bf9b-123208d40284", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468ec526-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767358, "uuid": "3e7ecc31-2e11-414d-a29f-ee39a4304c02", "comment": "Malware payload (Mirai)", "value": "4f70a66405c06057dd324c9d7cf8e7cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767358, "uuid": "ae1054ff-7e58-409e-a673-93b03ba5bfd3", "comment": "Malware payload (Mirai)", "value": "5f60ae5ef38941b524da5a9996e1445c55d0390950ca56796dcd110425c8a0c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767358, "uuid": "b1f89842-b6a3-489c-8336-b9b2935b2b3a", "comment": "Malware payload (Mirai)", "value": "ec0e9b3a09d017ee49b83f36dfe4b00f58f57d20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767358, "uuid": "2edec01f-fa69-4ac3-a7bd-2e3162e7e309", "comment": "Malware payload (Mirai)", "value": "4dabe7aa02fe2c5eb4d729990d111f8525e181a75a1a354674a3ce6e4266b3f387170f43ba3c9703d5040f122c578e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767358, "uuid": "0a82dd32-d5d4-44fe-8350-087d2f552c5a", "value": "T1EAF2F19EE4C9E894D9FD28F581FF0FB11F842084739F1BCC5703882C9AAC2656C990B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767358, "uuid": "7f7a80e0-6dfa-4ab2-a66d-53dd69720586", "value": "768:Zcic7wjLhqrKnTRHre/mw5QlPd1GtuJm1l6ywEHUhP9WD:+qUKTRHym0QlzGIw1lw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767358, "uuid": "eed71727-3004-4ff2-89b1-2d59ed0a88a2", "value": 37160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767358, "uuid": "52a69123-3cce-4cc2-8ed1-646ed6882872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767358, "uuid": "b165808c-a637-4a3e-a540-60eb7d7795c5", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407903fa-d051-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764770784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770784, "uuid": "0de95a68-e535-4a8a-8a3e-003c799fa52d", "comment": "Malware payload (XWorm)", "value": "0e5050bc6814e2a2b2fe1c5e784cea5a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770784, "uuid": "c5e75a64-f38e-4737-97fc-af944b2b9071", "comment": "Malware payload (XWorm)", "value": "5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770784, "uuid": "50018005-49b4-4497-9084-1b6fa65e2ec9", "comment": "Malware payload (XWorm)", "value": "841ba2d927a97a102334da548551ce7350336561", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770784, "uuid": "83b982ab-0db0-44b4-ae7f-c6b067231425", "comment": "Malware payload (XWorm)", "value": "24974f64859b63d97ef69bf3efd03593af685a376c3b901d931424bde81fd1e6c9c209150389bcfa7c06fd5bc3d54edf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770784, "uuid": "6f9a86d4-0802-45b4-9444-faa78698fdac", "value": "T1EAA38C791DBDE34AF38C90FAF815DFD29820B04859A5A363ED6DEBE03B254401F69391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770784, "uuid": "0877452c-91d1-4cd4-bc33-6405e7ff3363", "value": "c557e5a1f458562742f2063e4d1c8d84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770784, "uuid": "bd1f0266-59df-4b94-ad81-020d684db8de", "value": "3072:B3nPCRxK1PAr9rpfkeMjSyPZ2aBC71WVjKB:B3PCRxEYncjSwF014j0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770784, "uuid": "b160926f-d267-4631-b7e3-949e94b5a325", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770784, "uuid": "197d7c86-a8e3-4ccb-922f-155c6d22f915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770784, "uuid": "7fb2a140-c60f-414f-b7e4-1d3b32c94075", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfdd272-d01a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764747399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747399, "uuid": "2bed2779-21b7-40db-836a-4dec7995a175", "comment": "Malware payload", "value": "17992c80e99d268ec7d759d3df3cbfad", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747399, "uuid": "f92adb68-7413-465c-a311-a4fe713e7c40", "comment": "Malware payload", "value": "5ff9777aac434cae5995bf26979b892197e3f0e521c73f127c2e2628e84ef509", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747399, "uuid": "9cf7b008-3f27-413b-9970-06b616488e78", "comment": "Malware payload", "value": "bbfb0128fcb12c4ba499fe195bf7d50c0f9dad19", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747399, "uuid": "5d9dbbbb-1111-466f-9d27-f4f2bdfc9b38", "comment": "Malware payload", "value": "3c8dbae1453b9905a6608060595eadcf698baabe62d90a053b06374a7ddd0c4dd61a3359e7072d8a064d47afcabdfe78", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747399, "uuid": "62c91bf1-dd36-4eb7-a114-ee54bb1f148d", "value": "T129215212C4539E79A007A17B066A72D61B2E250CE8D7382E452D30F0318D889FEA6B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747399, "uuid": "6a350fa0-efc8-4942-b7ac-3b752eb964a1", "value": "24:yPtGu3i4fKlNewdUIlgejcOl5wr5zzczZK/vRFN:yPtn3iCKlP09Ol5wGz+ZFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747399, "uuid": "029e8258-fdae-4c74-95c1-688c27b625d9", "value": 1125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747399, "uuid": "e2869bff-c76a-4b5a-8053-e3c32c864ddd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747399, "uuid": "ec37df24-db39-4d7f-80d7-c68490ffaff7", "value": "Analysis_Proc_Report_Gem.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54c7453-cfec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764727708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727708, "uuid": "a9bf8615-8cab-4c79-a57f-b1a066855fdd", "comment": "Malware payload (Mirai)", "value": "7189284bcc60c92b4b1b334ac939124d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727708, "uuid": "24054f16-b041-42e5-aa61-0414cfecc0b7", "comment": "Malware payload (Mirai)", "value": "6016de63e46bc5f55383efe756ebbe1d11c50b12804302059143c84fc06bcd2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727708, "uuid": "94079664-f1a6-4e43-9b33-d7a754d3b04a", "comment": "Malware payload (Mirai)", "value": "8d7d50d6fc0cb002b6dff158775456da40b787ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727708, "uuid": "d44fbde3-0148-46a7-8100-95464d5edbbf", "comment": "Malware payload (Mirai)", "value": "fe29ebab8ee11c997a6e924c2e4577a3d264f9ab4ba6473d5c4d48e123ce68c7c587fe40eea8c366a973fc45eac51702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727708, "uuid": "4f7a6233-fc8e-4e5a-9b35-4a84766912ee", "value": "T1E3B3C652FA414551C2D544F2771B62883B1647FBE2EB3243FD250F90BBAA61F0A37AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727708, "uuid": "642a27e6-cc9a-41f9-8857-ccfa9d1ab681", "value": "1536:FMkYLP02ac36sORdZ2+wxvFng5Zglm8FEP7MnIMPwGRIP:rWP02a3dZAgjWTFEP7MnfRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727708, "uuid": "7464634c-06ed-4325-bc31-40831d6e6017", "value": 113080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727708, "uuid": "157da700-92dd-4396-a114-2ce6d0a0d53c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727708, "uuid": "692eec3a-d3bd-4556-836b-a6c2ad87224a", "value": "4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75754fe9-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746821, "uuid": "4ce19542-db6f-44fe-a4b0-89cdc5ac97df", "comment": "Malware payload (Mirai)", "value": "033c009672cf98e05e88467203f7d706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746821, "uuid": "8ebda2ba-837d-49bd-bfd7-191be8213c90", "comment": "Malware payload (Mirai)", "value": "6184c95af0c3d0bb886b0298184a6d05657d8a5737a272e256f0c8be71cbe2db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746821, "uuid": "f287cc61-254c-4abe-ba61-89227a2a54cb", "comment": "Malware payload (Mirai)", "value": "4c224ed6973cc78be42a5510817039b7d9df9a38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746821, "uuid": "b7dba3c5-423f-4386-ae2c-d967c293ddff", "comment": "Malware payload (Mirai)", "value": "93d8f7d41269efaf22266f2598644eb55efb7093c209346f6766792586345a357dbb836f690ef41b50c9f1e78c962c4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746821, "uuid": "b70b4c6b-d0e2-4b10-8253-d0644120fd5e", "value": "T12523F29EFC992FABC9590CB7D94C03750E90F1F8312D8A18EB462940B79BE5778C618D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746821, "uuid": "7ceb8b4b-df6c-4bdb-beb6-8caca3eee633", "value": "768:/1pnzg57CtrcROiJ1V8SwAROBPnkW1L2lfSFN0WvcXRgo9NRmTcedWM2:9pz8QOw2OR5icqbRgOHeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746821, "uuid": "861eb2a1-7696-4c64-b016-f9bb4b4dba77", "value": 47416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746821, "uuid": "6932fd44-0341-48e0-8552-2780e8ee42ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746821, "uuid": "86f204b8-af15-47cb-91bb-dc8e91138cc3", "value": "Yboats.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ca869f-d00f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764742338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742338, "uuid": "1e5d3045-ea5d-40be-b3be-36909b4404a1", "comment": "Malware payload (Mirai)", "value": "55edf56a765258affe7faabb03b83520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742338, "uuid": "6bf85458-ede8-4096-a738-a40d8406f3da", "comment": "Malware payload (Mirai)", "value": "6259f729edce03ee46db004d5943a8109ef330608738934d565c30acf2e4804d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742338, "uuid": "7a9e8894-eed9-452d-802c-2c338d9278e5", "comment": "Malware payload (Mirai)", "value": "575526a67150d5f4ac68f129c551aa16a9314363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742338, "uuid": "c2e2fe8c-a582-42b1-a660-4b80979356c6", "comment": "Malware payload (Mirai)", "value": "0e9d0ac871382185eabc21398016bd8ea9433491b38422d6085e2145afe269189c16746bee2106c2b640856a5ac7b951", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742338, "uuid": "a24574fd-3454-4a1f-bd4b-3304a1f09641", "value": "T11A13F1173F144AD0C09F55BC8A46BC525726C0757DE48E6A67C1B23778BAA0D3E282EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742338, "uuid": "ef6650fb-1d7a-4b86-8bc0-9e3e555884bb", "value": "768:2e6kWi9rfJoSiWaHFEicCOZ/LpefvtHsjwRawA4fSq1THhRw6SgxGEanbcuyD7UH:x6kWcG6UFEicCOZjsVn4Xm1Thq6SkGpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764742338, "uuid": "d7e04e25-550d-4fc7-b702-79be8caa8ccc", "value": 45540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764742338, "uuid": "cae5d5ed-3f47-4978-9385-60d1cdd1ade3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742338, "uuid": "362f9a16-1537-4964-88e6-86c56bb8fe1d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba88c041-d067-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764780437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764780437, "uuid": "1aa6c8c2-7df4-47a8-bb1f-ffa73c5535ee", "comment": "Malware payload (Mirai)", "value": "edd74bc8b32d2c5733b0d348ca6bda7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764780437, "uuid": "a25050e6-6ed7-4ef5-8c49-d613de7c035e", "comment": "Malware payload (Mirai)", "value": "635a32797a0b014a8b82672109cf682b7106e159e26b8ed48e0d7b136841bfde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764780437, "uuid": "7b7832a0-b8cf-40ce-8147-fe2e46faee45", "comment": "Malware payload (Mirai)", "value": "5d907e3dc93bb79477f42f20882a0e804d9c43e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764780437, "uuid": "caa45b41-ee0a-4c89-9a2c-451b855d126c", "comment": "Malware payload (Mirai)", "value": "b3ac9a7aa4fd860cee0ccd39e120dca742445d6b3f33337c1775feceda99f48c7bf8b0519bd6b6016ecaf2cf268c7b59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764780437, "uuid": "600fbbce-eef0-4755-8153-0a59a488158f", "value": "T1C5B36CC5AAD3D5F3DC0146B5309BEF328A72E47E012BCBC6D3E89D3BA959521801729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764780437, "uuid": "0e2faf78-4981-4d7e-b2ba-9b8da8c11bbe", "value": "3072:nxIEdTATS+yJo3fJFSaipi59WVxCtMKwRm0ow:naAE2+y63fHSdpsCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764780437, "uuid": "89453782-6f20-4280-b8ea-ad8874db7ace", "value": 112016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764780437, "uuid": "5ea78fa1-995f-49a4-821f-d5a9b24c69a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764780437, "uuid": "017405ae-e9ab-4057-8fca-bfcc44e88bbb", "value": "Yboats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9adc11f-d022-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764750854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750854, "uuid": "a788dcbb-16c1-45e3-a8c9-4d0132514183", "comment": "Malware payload (GuLoader)", "value": "2e7ed1ccdc6f0e133c0b83792a479280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750854, "uuid": "6bca6dad-645d-4654-abb4-d28902ec4f77", "comment": "Malware payload (GuLoader)", "value": "63b6d47b50a25d37ba2735981e95252d33862c1ae14c6f6a0128b14711dee466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750854, "uuid": "418cfe33-d0b0-49dc-9376-4a2a10797688", "comment": "Malware payload (GuLoader)", "value": "ff51bd3589015a1652bfea7ab42952df22d4ebfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750854, "uuid": "0ffba977-515a-452c-8426-34cef10aa973", "comment": "Malware payload (GuLoader)", "value": "f4c7e9cad8d3fa9d1dec2e242bf31e8e1667a98694d923d62ed162febc4000e5ebd36a58fadff544ba530e51390ac28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750854, "uuid": "8291de02-f38e-4213-81ef-06c888d752e7", "value": "T19784120076B69477EBE202761971CB7B6FB9E8720156AD2307113F197FA13C3A62F581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750854, "uuid": "270e3103-5dc0-4813-9328-d0f6b930fe73", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750854, "uuid": "ef49a2c5-9ba8-4537-b88a-37f607d15355", "value": "6144:NbE/HUS1pfdXbk6HZ+0rCnmKYklUfDpC2/7Y16cYoBApMDnKIUUmykLC:NbYc65+0+JlQpPDCK2GUmRLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750854, "uuid": "cd602300-081d-42c9-9757-95ef23cef19e", "value": 379360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750854, "uuid": "e6284e81-2a02-4638-9728-5b8b6195f6bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750854, "uuid": "47f6c35f-1d0b-4d19-9878-5bb648243d1c", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbba06c0-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749516, "uuid": "a08effd2-6016-4919-9f01-bb1df401b7b9", "comment": "Malware payload", "value": "b0f9675e290460cd54144aacb2a6fb40", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749516, "uuid": "fe90d556-d4a1-453c-8133-1f4454efe838", "comment": "Malware payload", "value": "63bb1662b1f3088aad52d9189f14584eacf9f7f8ae9b58832e45b5ab98a176c7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749516, "uuid": "91a046ed-277f-4eb9-9027-613400147cbc", "comment": "Malware payload", "value": "6656f52d170ad5c58f403485ecf0bf68b1c93ee9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749516, "uuid": "58e2083d-68ba-480f-9c9d-1340a9a5b1d1", "comment": "Malware payload", "value": "cd6e93f217c835cbe548d21847c7e9ef5fa8153cd8c55e7d86dd80100f25d4465dd6337fd79059fe551be71de1ded59f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749516, "uuid": "ad221194-144e-4cd6-9ea3-1b79d756ed00", "value": "T1EC8135744B264B57F8A87F509EA59414FAFD0861E7A10680B7FE4FD23F2268067B091E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749516, "uuid": "c6bbd30f-e14e-4885-8c7e-c98942a5cc58", "value": "48:fZtr4ihJMRgZ+w4IfY5f4XFyZ5LVb7/GN54C6pahH+1oeuh6sSxgQu19pgq9EqtB:fZtrtrM6ZbGwXgZTGNxMZ+6sSOn9E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749516, "uuid": "81f61ef5-d35d-4ca8-af90-78c6770dd2f5", "value": 3896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749516, "uuid": "27327648-b9e5-4f94-9b1a-25bac12c9bde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749516, "uuid": "9fa3283c-4ed8-4558-8f5f-23049be32ca8", "value": "e71hs62.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735edb1a-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746817, "uuid": "c1112565-7bda-4178-abaa-54e81601c770", "comment": "Malware payload (Mirai)", "value": "6258ce4affdf4b06a5cd3b2c271d4001", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746817, "uuid": "7b314efb-eca8-471d-b3a7-c315fb2ef63b", "comment": "Malware payload (Mirai)", "value": "63f12222899ed2a303643d9d674a6375680eb5bcab4fb2959789b6be44bd505a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746817, "uuid": "728aa8e5-8541-4eb7-8d81-2996a751b942", "comment": "Malware payload (Mirai)", "value": "fb24b6211277fce0c95586b06a29a9c86b60b10d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746817, "uuid": "aafdd3fe-f9a1-45d7-ae6a-5479f72d4984", "comment": "Malware payload (Mirai)", "value": "d752d3ca5cfcd559a5998caa23f93145e4ae587fb1ad5fad48e7948723e0b9c16e0fda9913c9fc8226cb0567f2c2f4ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746817, "uuid": "a38e41c8-22d2-46ac-a4c3-887223ab2721", "value": "T196C35C266DB72D27C1D5A4BB01B30332B1F7134A34A8CA1D7EB00E5EAF596A0315767A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746817, "uuid": "edb018b3-4928-4bc5-884a-24233d151662", "value": "1536:+GRZgkrawKQe+Hxj8WXEg3TST9mZvWkjBs9bJOUfo/yaPJlk5ikAmCTZtOO9YIgm:+G7gq0sLVZvWv9NiPJlUfAmdLoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746817, "uuid": "1144c023-bf09-4bde-b676-62da798310ac", "value": 128320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746817, "uuid": "6bae427d-522e-4078-80a5-6b7ef47a43ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746817, "uuid": "8c8b56dd-feee-42df-a018-1cd59752c26a", "value": "Yboats.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b57c52-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764746709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746709, "uuid": "425a2104-b4f4-4052-aa50-5d4f64e8013d", "comment": "Malware payload (PureLogsStealer)", "value": "d07db6f3d4b38714d1fd4da8bdc4f427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746709, "uuid": "814d13f0-9d44-47be-92b3-ac71dd50562c", "comment": "Malware payload (PureLogsStealer)", "value": "6419d74ea82b7c45bac56aba550a556791e76110e1af3c07794773daa8900032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746709, "uuid": "f05246c6-2999-4283-834d-887b7737a22c", "comment": "Malware payload (PureLogsStealer)", "value": "23701b3b17f05fcd1ca9c9b1c12c9ea8f9c44e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746709, "uuid": "ece0b949-e5f9-4cb3-9c57-c2f778b6bb9d", "comment": "Malware payload (PureLogsStealer)", "value": "cb4f1c91d4c3753ead9be1bc5b6b5eebce35c5a1317a2841684346fdc20b0eedb9c3071f29b5d9ed889d704adcd044d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746709, "uuid": "617f2a42-a6dc-416e-84f1-f2ba85307101", "value": "T1323512071A18CF13E05957FA2D63CA7917F57E5E7011E29B8EDA4CCFBA60B114C8862B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746709, "uuid": "3f7f2e5f-f34d-4383-8f5e-8418aebe261f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746709, "uuid": "6e571034-37a9-4caa-bd4d-bafaf6f4d4f7", "value": "24576:IGrnwfntWMlFbicvaZ6VolTMM39+RgBVhm2vL2iHC:IGrwfntRjicvaZ0sTMMugBpKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746709, "uuid": "84fd57df-6600-4212-8df7-e28d516a3309", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746709, "uuid": "0b39a61f-6930-4ad8-a33e-5bf645132ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746709, "uuid": "ba125a22-3dc8-45ac-9ab5-d9b3e053becf", "value": "d07db6f3d4b38714d1fd4da8bdc4f427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a320efb8-d09a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764802302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802302, "uuid": "754f4b18-c7cf-4b7d-b1f1-5e1562a20717", "comment": "Malware payload", "value": "2a8f6fba685ddc28afad1f449f0cdeca", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802302, "uuid": "348a34b6-5d3b-437e-9a06-88f18441b41f", "comment": "Malware payload", "value": "645a92868887410903fcf5ca1080fa02e52534da117c1e9e318e13dd2c71a89a", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802302, "uuid": "626c3975-14d7-41f1-89f7-e7c618aa56eb", "comment": "Malware payload", "value": "904aabc5d8fd14aa99a7690b0790c66e21706a58", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802302, "uuid": "b360c816-7743-4e68-a17e-a0a287de26a4", "comment": "Malware payload", "value": "ea284ac539e86d8938c8519547d9072829ae8f25ede7e5a4ef0dec332cc65d4ec2a45315b1e1f5e31949d04bab191035", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802302, "uuid": "f799ffbd-ad52-4250-8ab3-69b230e0adbc", "value": "T1A99523063281D911C8D7E2B45A87ED8DC82CBD01FF8969016B2BB77B3C75B7112AA74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802302, "uuid": "a2110004-dee2-451f-b2c9-f64c8402099e", "value": "49152:U+62dMsTugmVkxQ4AREQ4hdO1/ZOco+As:UgdXTYVt49A/ZAHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764802302, "uuid": "dc08b681-b8c0-4567-b355-52fae39879ad", "value": 2022912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764802302, "uuid": "edafff0c-bd44-4294-816b-6989a92ce289", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802302, "uuid": "56260911-01d8-45c0-909f-f0d83ff11a69", "value": "SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.8948.6434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d8d5e6-d020-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764749662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749662, "uuid": "de5d5947-ef83-4369-8a5a-7c984161f937", "comment": "Malware payload (Mirai)", "value": "bfc4515f69b276a893b17890e09c365e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749662, "uuid": "bcd94754-f0cd-4de7-a744-bac5a61ca58d", "comment": "Malware payload (Mirai)", "value": "646f7dbeca021e36075eda4a2a1728e39f70d07416f488167aa9e6b92ee5a868", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749662, "uuid": "c2d04dd6-70a6-4b0e-a5a5-6538a0789dd0", "comment": "Malware payload (Mirai)", "value": "1e606f7169d827de528fba9cb1d11ed3791cdb85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749662, "uuid": "4ab48397-ce5c-46c8-b8b8-442f02e8091d", "comment": "Malware payload (Mirai)", "value": "95bc4f9f8e37ef34aa161dc58bae08f5d15ce8f82b5b6bb05aab9b1bdff2a40f6eb240a8fa2162f368c1f1263db2fef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749662, "uuid": "18d419d8-399e-4c8b-b0d2-63a184b9328a", "value": "T10E23F2F540C93E23E7605C31BDE64ECB16978F7C66CA11706EA406302DE570FA674A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749662, "uuid": "30c96539-0d27-4d4e-a8b3-b1af932c7f37", "value": "768:RIITRlhmDyw2+drNGNlMVQY2NECHYIfy69cGowW4S9dV+EmjB2NE0Nghys3UozO:RIcRHmD72EN0lM6Y6ECjy6mGowW4sLN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749662, "uuid": "18a18dcd-5d22-4af6-8132-bcecab3eb29e", "value": 46124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749662, "uuid": "1ddee884-f223-4025-9d6b-0b37d36b6c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749662, "uuid": "c01fe9af-003f-4c52-9d69-335f43aafc20", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464979b7-d00a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764740299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740299, "uuid": "c9f3b44a-d60a-4d0c-b1d3-b014d7461627", "comment": "Malware payload (Mirai)", "value": "da13b3ae93e22066877324b1af022c9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740299, "uuid": "e610af00-fb53-4d96-a902-392da2cc152e", "comment": "Malware payload (Mirai)", "value": "647cde4a1a3895ea54d40875a1120c426142f7467d0afeb297c2911bd26c6280", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740299, "uuid": "6266707d-c185-4bc3-ac95-92d2e7e39649", "comment": "Malware payload (Mirai)", "value": "b3ed246a806aff89ee8cea8ad819365d83cf500b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740299, "uuid": "aa786134-e618-49e2-bff9-494b85b588da", "comment": "Malware payload (Mirai)", "value": "48da0d2a59e47aa1a09dd6bd4ecd15289192824af006fefe2d44deacc77dcff437e86dfa2a7c41926a6a9cfc243d081c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740299, "uuid": "5565998f-1eba-4427-b066-07495311fa77", "value": "T11F835943B984C0FDC05AD13447BF6237C863B07D1239B29B67D8FE227E49E601B69999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740299, "uuid": "043b86e2-8f1a-48e3-94d8-2b411f1fd86b", "value": "1536:PwCKY2qjgSD0rT6W9y0eAljsJFyW7MZ10MlsEU1RrqNaLLs:PwGjgSoT6WcRJFyao10MlsbrqNaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764740299, "uuid": "b5aa0864-f201-478a-b114-b757df3de54d", "value": 82784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764740299, "uuid": "18f6bde5-e631-4bcb-bc2b-20107bfc99f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740299, "uuid": "5133f1b3-97a7-45db-878f-1a4f0173ed1b", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfac2aa4-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793787, "uuid": "c93aad07-684f-4a49-9eda-c4774e9a7854", "comment": "Malware payload (Mirai)", "value": "a3a8b5ac168c6c6dcbdb2f4a8272491b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793787, "uuid": "2daad1f1-4e42-4e4c-8f99-a8c6b37b0b79", "comment": "Malware payload (Mirai)", "value": "64c1492109495906dfedbdf64d99a0b80d5c32ac8a5665135b000624ad2eccbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793787, "uuid": "02ef49ff-a2f1-4122-9fb7-eabcc46833a6", "comment": "Malware payload (Mirai)", "value": "266e834cca8d69e1dca97ff76919ee4778bdfe72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793787, "uuid": "3ab0c680-b903-4da9-9a32-ea2fe50e7d1a", "comment": "Malware payload (Mirai)", "value": "83a690fc6676e69fba3dd13e7ce21d6f1341e742819ed3b5d1e44570dbb0c271d200c87086b5848e6cf1c8ebbb604b57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793787, "uuid": "d7e34978-c672-4836-8c6d-e3923ee28ef0", "value": "T12803E1F2A1AB53C1EB1660378B4F728B4884D4064B248571DDAE308F5DF5FA20B2C5F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793787, "uuid": "e9ed07df-3c2f-4f45-ad1a-bf8ed3488380", "value": "768:4BO76DeEZYo219FxI6LhQy7VWHhvattcCEGhfZT2ORnbcuyD7UHQRjE:4EjjooTI6LPkC4pofZT/nouy8HyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793787, "uuid": "960c135a-50ac-4575-9a39-3753e557d752", "value": 41188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793787, "uuid": "87033650-4eff-466e-b662-138fc8f26f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793787, "uuid": "f4940c1a-81b0-42b1-913c-30dd1209ed67", "value": "zerobotv9.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e7c1cf-d040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763765, "uuid": "4352ac09-56ff-4b88-b884-fb40b5ed87e8", "comment": "Malware payload (Mirai)", "value": "c64cef19007710b4081e3bd807e1ae08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763765, "uuid": "92dc6864-4da6-4399-b44e-ceae347cfade", "comment": "Malware payload (Mirai)", "value": "64d6b4663f85c86d68de53d3be0b964468cbb3ac83e04e24be8485168616844a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763765, "uuid": "a77a4d92-217b-472a-9c80-2d373aa06bec", "comment": "Malware payload (Mirai)", "value": "0a9e20c7f4d65f70e132ac2d4d5acfaeea2d73ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763765, "uuid": "53ec9bfa-6c25-42e9-ae10-510042b4aa94", "comment": "Malware payload (Mirai)", "value": "832911299d72ecbfe9d34507c10273b7f0ebc386a2877bb253e4e1446ff3c004aab5565ea5da2c9e8689dcbecdb14b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763765, "uuid": "48223b63-812b-4f0a-acaf-8a80f1754143", "value": "T1C5D36E86F4019E6CF89ED27A4537490DF021A25466A20B27F367FCABBC330A55F1EE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763765, "uuid": "f1a1eb40-9585-49b3-ad4d-bdcb4588d0dd", "value": "3072:jkq4hz5PkiiVUmBjNULvYZZ66DmHhRW/sanQIdJ6k:T4hz5Pki8UcjqMHtma/sard0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763765, "uuid": "7ceecae6-9d84-472b-ab4d-3368571c9338", "value": 131700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763765, "uuid": "9b2ecb14-213f-460c-a35a-1619d5e73cf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763765, "uuid": "8271c470-37e1-47a7-a3bb-a5db5c72b79e", "value": "Yboats.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c157546-d058-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764773729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764773729, "uuid": "7c3fb1c8-e9ae-4f6b-bc26-daf2bbe08754", "comment": "Malware payload (MaskGramStealer)", "value": "e46b2d3f6715596ceb957defac4f82fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764773729, "uuid": "3639030a-a045-4208-9184-cae758e02885", "comment": "Malware payload (MaskGramStealer)", "value": "64e714b6db5a170d195cf7f5ce40a50e0ecf4b59d591fbc4cf282ca37496c952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764773729, "uuid": "4dd25df0-fc76-46d8-bb20-7ae85a131685", "comment": "Malware payload (MaskGramStealer)", "value": "5726eb7960be22c972d7f1f1f5e785ad4101f433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764773729, "uuid": "3eeedd26-dffc-491b-8dc8-77be50befea1", "comment": "Malware payload (MaskGramStealer)", "value": "dd8d0ad932e19edcacb48df7542db3ffdab2d1017fed6efd1e8dd24d7edb12b1199cc6511e5105896913705115720a73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764773729, "uuid": "dc663362-8111-4172-929a-4bc2b39c25e4", "value": "T12D7623926AC922F4C0C34B34618611CF75E17E5545F99B1E35C27C03AFB2E9E098F6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764773729, "uuid": "3fd84af8-0559-424c-8988-5231cea05ef1", "value": "ea281082cd6342019a4640d5d7089aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764773729, "uuid": "d3d7d43a-43dc-49cb-bdaf-2c7fb5e132e3", "value": "98304:EMpDhDUeu88TqzIp0VOf6uGjyPXY120OSVgD7vAkZmNnVHiQQuuzk1hdrIDTyn:HpDJUeuhqM5yufIQEK3NZS5x1hdrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764773729, "uuid": "b2bb87c2-5712-427f-a157-a2354eef2271", "value": 7198720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764773729, "uuid": "e3063698-fd48-45a9-b9c4-44eeecf26992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764773729, "uuid": "384ca1b1-b960-4085-9256-c4fdc76b4c9e", "value": "KiddionsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3d62e0-d0a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806188, "uuid": "2cc8b0f3-e8f7-42eb-bc01-ddf392919d85", "comment": "Malware payload (Mirai)", "value": "8a52791bf84a9365caf2bd84b037a5fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806188, "uuid": "596b52dc-bc8e-4da2-9299-dd8babab0593", "comment": "Malware payload (Mirai)", "value": "652a1939df5bda46e78e0c218dadf63b7a0f7f6b79375ad792d38082a600309d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806188, "uuid": "751e969e-a44e-4829-9a07-482d507801db", "comment": "Malware payload (Mirai)", "value": "942b6fc3b46b6de7a10af1c419f614a1408a8cc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806188, "uuid": "c4c4bf78-db01-432c-9aba-38f6007eadf7", "comment": "Malware payload (Mirai)", "value": "e22962a351ab7fbbb862e34e2114ca654c344e73defcc165ecfe6c85385068549faafbd9fbfc2dba4b48b3447a6e20a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806188, "uuid": "7ec5fb46-92de-454b-bb15-6605a9466c59", "value": "T189B34B57B9C18CFDC2A5C13407BE793BDC21F0DD0238B29B67D8EE266A4DE610B19949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806188, "uuid": "3508ea3e-656c-40b7-beb5-5afe162a8d5d", "value": "3072:PeKYd+ctkV5HQWKIWRge+63P//x1LdeDbo/iLPRe:PeKYdhkV5HQWKIWHr4/o/gPRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806188, "uuid": "c9ebdb34-b1f2-4463-8653-a01c0fe92b27", "value": 117216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806188, "uuid": "27bd1c0d-7979-4ad7-aadf-2d8ce8992872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806188, "uuid": "924bf515-9f19-4ce6-b5a9-f0cabb8cff71", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d4cfb4-d0a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806164, "uuid": "f6d01082-a0eb-4826-add0-17ac7135ac07", "comment": "Malware payload (Mirai)", "value": "bc083e17ba1c547d66929976d676f256", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806164, "uuid": "27df43fa-0d7c-4990-a26e-04e8b5b04bd4", "comment": "Malware payload (Mirai)", "value": "657f9635d1d880f6d4dbfb061f0a665fd0a111c09f18b370831adac5cbedf85a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806164, "uuid": "1f330f16-f8c3-4466-b374-d5ba8077c89a", "comment": "Malware payload (Mirai)", "value": "f78696f96bb0cf70f751a3624fa0f590ac7022b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806164, "uuid": "3e5b550a-a404-474e-9402-6dbda9a3d365", "comment": "Malware payload (Mirai)", "value": "fd9abb1611e3bf850b57e8506363ef4426c42e05dabcb7d82254bd898fba746f276335774a9c5d6f4f437e9d139bbe6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806164, "uuid": "7a86aec4-f84d-4c7d-bf2c-8ff28974bdd3", "value": "T16023F13770A44554DE3E8C7411EF7A1E8066C22956211DEE5CC5836A8B8EF3B732DECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806164, "uuid": "30cfd719-7c00-4887-aa5a-1a26125d5752", "value": "768:SVBV2mJB7+0d8IGUS72l6X3i9aZKbsWcGnJpFqqbw6ohD6mNQ1b/k0bdKnbcuyD/:SV6mJB7+k8Ie2l6XLZKYWcGJvqmszG13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806164, "uuid": "86019b84-9bf3-4cc1-bc50-b0bbd8ca224e", "value": 46728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806164, "uuid": "edeb59d1-9795-4822-bd13-b95509c0a228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806164, "uuid": "c116d509-d033-4ac7-8c6f-9f92ea4133ed", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b0d877-d07d-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764789831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789831, "uuid": "01188da5-5a9f-4c40-848d-d7b7a18281a7", "comment": "Malware payload (ACRStealer)", "value": "c6bc327a74d1a50ed713b92b6a0f59ad", "object_relation": "md5", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789831, "uuid": "df705fab-f70b-453f-b04b-37e10ad8db58", "comment": "Malware payload (ACRStealer)", "value": "659c31a6b26b23e18ea9d81e986f91ab3dd489e149d7dc8bc11b6364d1412a23", "object_relation": "sha256", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789831, "uuid": "27797189-da0f-43ee-a505-343ab54c0f49", "comment": "Malware payload (ACRStealer)", "value": "975b18192b16044edc8c5365ba97d339a733a172", "object_relation": "sha1", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789831, "uuid": "f158e680-3c16-461d-94d1-4d6f6e440a58", "comment": "Malware payload (ACRStealer)", "value": "fcbcffb820cc5aa01d3b93066dffaa67c95250fc78b8c7db541d0a0a51e8efa7d1e1488f9cf12b13e7ee92f01fc8f2ac", "object_relation": "sha3-384", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789831, "uuid": "661f26d7-a0d3-4eff-86bf-74111cf2292c", "value": "T114A65A10A8C82607FD7ADFBD999E76500F7AB5952541BB288F5209DD3ED1B68C8038F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789831, "uuid": "806d722e-c8e9-4f51-9fd2-f6b812dd7a30", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789831, "uuid": "78e9919f-9e2e-422a-b61b-0a75e2e70945", "value": "196608:eQmT5ue/d3h76yanzgyDiYxWFlnFhx8R:wEe/SMyDi9hx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789831, "uuid": "a26d762a-77e0-454e-961d-00ad00f161b8", "value": 10065920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789831, "uuid": "05642f9b-5a99-4e48-8740-b6dd7021fd37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789831, "uuid": "eb35cd9d-9146-4353-8d59-83316e16a67e", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc84815-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749603, "uuid": "9a5e13f8-dd4d-4124-8b66-8907aee52625", "comment": "Malware payload", "value": "bb1bae18d7fc822f95e2ec0870cf33ac", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749603, "uuid": "cfe325f2-7632-4260-8ab7-cd2121b1a0c8", "comment": "Malware payload", "value": "666ed8080e6a23444c8be3691110c780742df286936a19cfc8b2b8c2288e2be1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749603, "uuid": "cd600d42-90a9-4997-8126-f6e028f77341", "comment": "Malware payload", "value": "35e36ac966cae8f134cdeb6d4e27cc081cc878b1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749603, "uuid": "028f5807-6db6-4e4a-84a7-b29df4d402af", "comment": "Malware payload", "value": "7029273260546891c0acb1d76b385f5ba7431fb1c6a0e38e0c96b03e7f27942f1d967cf198d009377a26ec8613dd3654", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749603, "uuid": "ec8f68be-574e-4621-8c7f-ddaed2fe0488", "value": "T18A071262F3C8E86AC9F3D33749754A66112A0C668B93D7876929733C29B39D04B4DFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749603, "uuid": "7fc9904a-1802-4aaa-b631-bd19de45af09", "value": "393216:VJYM9qEC2Xx1VOcPN4rDHFHFvse6ZZTEYevVIOd7OjOzu+eP:VJJ9e2Xx14cPN4XHfvWrTsdMY0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749603, "uuid": "e48af1b0-39ad-4a1f-b681-d4e2e9c820dd", "value": 17839218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749603, "uuid": "3388642a-bc61-4737-923b-648369f08fa4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749603, "uuid": "f4b384b6-709f-4bf0-8177-53b1202bbd07", "value": "\u0634\u0627\u0645\u0646\u0627 \u0628\u0644\u0627\u0633.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53888a7e-d08e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764797015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797015, "uuid": "f1ee4c42-ebb8-4aa0-bcbd-cc6e947bbbf5", "comment": "Malware payload", "value": "0cdbf1305fe5f7fb40bab851a40c1d77", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797015, "uuid": "dfa03bd3-ae04-45df-96bb-db63eb764958", "comment": "Malware payload", "value": "66cee30a999770e51c8a80b6aa279607cbbb27bb581bf8763421777559869281", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797015, "uuid": "e39b70b8-dd92-407d-aaef-dd5449336c77", "comment": "Malware payload", "value": "b4c2a54712e032018660e4d0f6bb4d9f303f4091", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764797015, "uuid": "2c4a49a7-76f4-44e5-a0f5-1db141d995c1", "comment": "Malware payload", "value": "7ca88d3e101b9e4696af5c24872d5a0537ccf56c3961832c12c65688126a1902f39bc991c65968737828c378599ee4ac", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797015, "uuid": "069474d0-927a-4e12-b64d-c7bf5aef496a", "value": "T1C5B4D00937A410F8E467913DC9A79A46F6F23855073097CF13A487B96F2B7E16A3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797015, "uuid": "37b00f2a-3c44-4d2d-903a-e181ab5cb2e8", "value": "78f0b9037223ba008b9e0f5ebe07069b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797015, "uuid": "a98440f9-5083-4954-b312-938e112bf5fb", "value": "6144:QMhyzNBunRVjnT2XvZgXXvWsIvWX+qYVoj4gw8RHtVRMo8awE4jP+VhpnRXxGDr:RyzNgzVaWX+pq+qVRMo8aBmmnpnRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764797015, "uuid": "ef3a46c9-661a-4ea9-863a-a0d180d4e958", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764797015, "uuid": "4a48615f-a33f-46f0-87ce-dbba2792feec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764797015, "uuid": "685da7a7-8689-4fa8-aa84-96e0aeb8dafa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acf7055-d042-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764764305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764305, "uuid": "d53a8987-9648-405f-90c1-fcd72ce3fd39", "comment": "Malware payload (Mirai)", "value": "0d12d17c6844beb6c2b89cae996ad398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764305, "uuid": "a5d4f9d6-58ab-4bd5-8ea6-63c3238acd3e", "comment": "Malware payload (Mirai)", "value": "66f8c92f52b3624d772aab0a43ee237f0d80e69f4c058f8e0a7eaefb92d0f54c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764305, "uuid": "4248957f-8064-46a7-be88-d88159d5db45", "comment": "Malware payload (Mirai)", "value": "3207be98515f99ef9c33acd540d3722233ac9886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764305, "uuid": "1370f9c6-2ad1-4e96-a4f3-f1ed18fe3218", "comment": "Malware payload (Mirai)", "value": "ae7e3b141aba0b08cad0dde83b805c8c1343f693aea28a7e4fc2363b1dbdbf63b02bb3b2bc479cfa9c549f4f5fb12944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764305, "uuid": "97dd96a9-0bb7-4813-bd01-0c6838c44e93", "value": "T1B6E2F2A189448375ED601873FBB80A066327DC7275AEF4F63211C136F4A74B1BBAA54D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764305, "uuid": "1acca4a7-58d3-4f2b-a9ef-3d6a6a9c0b84", "value": "768:z+xDlRz/lXzyt2fiW+gUwgu1OeIjw2qfV3UbF:z+tPdXrfL+hwgZeIGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764305, "uuid": "a2b7b702-be4a-42af-865d-d960c8806513", "value": 32596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764305, "uuid": "0056db69-2e97-4e64-ba7b-5a23d5e2b4a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764305, "uuid": "ff69075c-27bc-4fd2-9cba-74c3255e2294", "value": "Yboats.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02fa5aa-d02b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764754731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754731, "uuid": "476b5f61-1fd2-47c8-bf95-ad6ebd9ae598", "comment": "Malware payload", "value": "0323bf217aadfcc15334b8bc1d703387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754731, "uuid": "1c9d853a-dd65-448f-8bc8-2c4331385958", "comment": "Malware payload", "value": "672c64dfa45d7c0d2611bed5d00702853c1cc61eea8b177f8bb59ed0e5c17db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754731, "uuid": "80b4fdc6-1d5e-4442-bdcc-017ab6a0914e", "comment": "Malware payload", "value": "8469448a6bf9dceedca128e3c03ec6f13d1dcf94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754731, "uuid": "a5902a41-a62f-45ca-b9c4-2bc91c8c1b45", "comment": "Malware payload", "value": "8f84225c3a528f4f051dab7e80068f53847cdbec7861f01d107b53d289a9a7c339ce704567464ff2367a7db16f45cb3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754731, "uuid": "9732b928-88b3-484c-8f4b-d4634c699030", "value": "T1A405F1ED725075EEC857D4728AA99C34E1466C7F071BC20358273C9BBA3E5CB9E148B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754731, "uuid": "c48108bd-90e0-4de5-873a-fc91ee3fbe79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754731, "uuid": "16936568-6135-44ea-a1d8-d8f667fea8de", "value": "24576:I5kf0XKTu5Fi+4r3UlmV9KuU+fQQUaLxDSRmj/kDLqwn:f2KTq4H3UkV9Kuv4QwYj/kDLqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764754731, "uuid": "d2f80cca-1425-44d5-805e-488f976e8b57", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764754731, "uuid": "b6b12c57-7117-49c9-8e78-41aa483fab39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754731, "uuid": "5a851d2d-72c8-4f0b-99f5-50ed2fc52518", "value": "Comprobante.transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07d290a-cfef-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764728961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764728961, "uuid": "78016f86-3de0-4d01-9137-06cc1822484e", "comment": "Malware payload (RemcosRAT)", "value": "5e98e4dfb80ddbeb480fb37c233d6f44", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764728961, "uuid": "7fd76571-faf4-4142-8e24-5a924ba71b1b", "comment": "Malware payload (RemcosRAT)", "value": "67dcb03549ffff37f461654efb7ade244bcd032d9f68a598771d3d0cacf1de2c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764728961, "uuid": "1307e9bc-8d25-4589-a547-7743a2bbaa4c", "comment": "Malware payload (RemcosRAT)", "value": "e33668d1ad563be9c946b91a9a609c3d56ccd8e8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764728961, "uuid": "a5246858-199f-4936-8852-daf4cc83b159", "comment": "Malware payload (RemcosRAT)", "value": "963ee4459006fc1744e0e86c290461ce42afe0b406952a23312d2d1e29010270d68471bdf72a753e6dc80cbbd6b98185", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764728961, "uuid": "314ffa12-acae-4856-8f50-9ebb7078b733", "value": "T1ACB49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764728961, "uuid": "0623c30c-f388-4226-b015-38f160cd1b8b", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764728961, "uuid": "cd3d7216-d9d7-47f2-b60f-f17eb89eded8", "value": "12288:y6pxxGI8gvGOHJpAbDYGxLhZ+sPZtOmPFN:y6pxxx8U+bDYGxLhZtZnPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764728961, "uuid": "a49b1546-6476-4f6e-95bf-419135ae4eea", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764728961, "uuid": "08d2035c-526b-4cd9-9519-902edb9bd095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764728961, "uuid": "203612e4-cdb8-4609-8784-5a583dfba512", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ca2160-d03e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764762684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762684, "uuid": "34e1652f-5898-45d2-ad19-60f01bf36532", "comment": "Malware payload (Mirai)", "value": "1d376ed873faab349b6b7cf63127b322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762684, "uuid": "ddc9b3c5-b16e-40e6-86fa-7f47a1a58be2", "comment": "Malware payload (Mirai)", "value": "67df849f3252e566ca8f73336ab31eb7b5ddb277c91f90a9dac885c9d9de3837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762684, "uuid": "6159a096-bbc1-4474-b7e4-19e4225fd849", "comment": "Malware payload (Mirai)", "value": "6b34740c5871b40f019bc2e934406a617727ad38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762684, "uuid": "73e0941f-7f95-4ae8-86b5-f73e114c0703", "comment": "Malware payload (Mirai)", "value": "d70fb14d287ea13dfef101e1367fb3069e31e5f41f7f6daa0ae5b89d8b1728844b04af63648f134251a477081cc1076c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762684, "uuid": "ea97b891-2d2e-4ff7-a2de-2adb4c70e9c8", "value": "T168D3940E2E314F7DF779833587F74E21976963D622E0C689D2ACE9011E6434E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762684, "uuid": "ea0cbd9f-3b85-41e6-9dd3-deacf8e5512d", "value": "3072:sC+osHRHvM3+alNYohWHuSpSmal/6uwVeICKlzERASbZgEzYcTskuc2l4qttkL/p:sZosH1U5lfSk5gpORPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764762684, "uuid": "d0da6e03-7182-4d4d-b239-9fa791c9f36b", "value": 142684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764762684, "uuid": "fc3e25ac-33c8-4542-9c1a-3221174904f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762684, "uuid": "19569465-700a-4571-a25f-8d0728367028", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17855dde-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806363, "uuid": "09ed3008-8369-4d5c-9ddf-8ef3f116a1a2", "comment": "Malware payload (Mirai)", "value": "79d87006fd28a74c9a71854e30c5c614", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806363, "uuid": "efc52320-726e-416a-95df-941eacfd28bc", "comment": "Malware payload (Mirai)", "value": "688398e3bd0ffab016141727fa34b0b20cf89a109a16ba8a4c31c9941b2eb5df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806363, "uuid": "954eb7f7-5102-4643-bd9c-ebdc0ceb08da", "comment": "Malware payload (Mirai)", "value": "f6bf016d914b16c772a079852c4af6ea860c1fc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806363, "uuid": "8561c4b0-7bc1-48d7-bdab-8b14566e5a98", "comment": "Malware payload (Mirai)", "value": "b6af079b6964ebbf0230ba70c9b1c6025a255bfc5707aefb787c1c133cd82664bc5a0317827e4e0f96a03568eed539d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806363, "uuid": "afbf7502-9138-43be-b484-fe717243ac71", "value": "T12DC32A45FD818A22C5C712BAF92E118E331217E8E3DE72139D149F2177CA62F0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806363, "uuid": "b0bbf0c1-5226-4869-bf62-cd67300b6f0b", "value": "3072:eSWgnh64QOJautPuk3QeLwcTpqAla49LmE75Np:e5q6fOJautPuKLwcTAwa10Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806363, "uuid": "9ccc5989-754b-4875-b381-c6682d608996", "value": 128676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806363, "uuid": "20c53ac7-e13d-40e6-b659-7cbf4606e81a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806363, "uuid": "a988348e-a38f-48d5-83eb-fe2339e86618", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ce1809-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764746657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746657, "uuid": "ff802287-0782-4e14-9239-0e647236fdf2", "comment": "Malware payload (AsyncRAT)", "value": "58c96d14b75d1118fdd0a090440ee257", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forsizillenazzlle-duckdns-org", "colour": "#DA7A42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746657, "uuid": "64ed9800-13ac-4e22-8e43-5ceb7f7a1a94", "comment": "Malware payload (AsyncRAT)", "value": "68b20156f91380f18d34a84d51f7be308c494edebf353462331b3eb2212cd953", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forsizillenazzlle-duckdns-org", "colour": "#DA7A42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746657, "uuid": "bc668a4e-259f-4c81-83d0-82d5b802798b", "comment": "Malware payload (AsyncRAT)", "value": "274e0792ccccfcee809aedf0fa1abed9d3e5588f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forsizillenazzlle-duckdns-org", "colour": "#DA7A42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746657, "uuid": "587ff73c-939c-40fa-b1f2-5adc4a6ecbe6", "comment": "Malware payload (AsyncRAT)", "value": "41ee194a15b3cd6187cf683eec7562e0ff2e3413f7a733e848df74aac135612e1de38e930bca897b50b306ba5078e543", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "forsizillenazzlle-duckdns-org", "colour": "#DA7A42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746657, "uuid": "08ec14c8-b246-4df5-9f00-6e278d9f2daa", "value": "T16CE24B4877A08312D5FEAFF02AF2710A5274E51B9D13EB4E0CD48A963B639C246507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746657, "uuid": "1a879976-9ccb-4bc3-8754-407902cf62e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746657, "uuid": "60610cc2-4e33-4374-93c7-7c5a404d8901", "value": "384:CPaJByq2WqO1Hk/xMxXZduPLOX2L9oTvh0FbOKTCOQm5RApkFTBLTAOZwpGd2v9J:hBMYvL9C2TvGFbO75m5VFo9jHOjh8bF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746657, "uuid": "0f2db5d6-a29c-4bef-b9a2-bea1eaf47065", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746657, "uuid": "c60cb99a-a72b-4a1e-bba2-8625990f6bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746657, "uuid": "1d9bcfd1-00e1-45f0-aee7-55c0879d11f5", "value": "68b20156f91380f18d34a84d51f7be308c494edebf353462331b3eb2212cd953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854f4cf6-d0a3-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764806118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806118, "uuid": "27dd07d7-3891-4631-a5cb-2f59d79a775e", "comment": "Malware payload (ValleyRAT)", "value": "a83816bdd57165a0f68cec0b695c209b", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806118, "uuid": "d19a38bd-074c-47cf-bbc4-7aa89ff1e25b", "comment": "Malware payload (ValleyRAT)", "value": "696e8efd62b841651509feacedeb5530fb6abe3e1b3b41d7cc804d667230afc1", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806118, "uuid": "79f57b38-64cc-4b7f-8cb9-4498e7e59e3a", "comment": "Malware payload (ValleyRAT)", "value": "28660c44ea782ad5bb24fe17738e615d297a72cf", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806118, "uuid": "bec94327-5e73-41c5-bdb1-3e6af433de1f", "comment": "Malware payload (ValleyRAT)", "value": "5e7d0db72465bbea4c657c6c30dd18a5d2aa3bbf69e6fe2edf5f9b55cef88b567d5a552ae9472c411006a9b0eaf7bee8", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806118, "uuid": "1dc145b3-0df8-4e57-9dc6-2057e10a4f01", "value": "T1EFD73330B17629D8D62F63BFE1A85FC58030BDE1B317D66B73787BA549B164620B2843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806118, "uuid": "7bc29a65-11e9-42ee-a3d9-69af41a88b6a", "value": "1572864:KyG72vTdWx/nhnuapEuCANgp4FnsyZCr6Vh2yoB83:s7eTd4nrpV8WNBchy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806118, "uuid": "e3abe11e-98fd-4b50-b356-cfb9220b6931", "value": 58800128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806118, "uuid": "e9f305fa-3e2c-41d9-96d9-5d8cf9e92c06", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806118, "uuid": "06547c5c-35c9-4236-9767-a8c45d48ce2c", "value": "888888.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a96f1b-d03f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763041, "uuid": "3199da54-a89d-4677-8425-f4a58a123990", "comment": "Malware payload (Mirai)", "value": "920c3e5cb6a5240e970726b8a7af081a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763041, "uuid": "7f351400-65ab-4e17-bc13-a723317edb20", "comment": "Malware payload (Mirai)", "value": "69fa9af3f6e1a3270c3774b5640e3efdce53dff652a6d8c53c9d7bd7ca6d104a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763041, "uuid": "eac7c974-f8d6-42a5-b08d-3cf8edd01f31", "comment": "Malware payload (Mirai)", "value": "4d13cb6331a6534e5437a48c8adaa36af605f840", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763041, "uuid": "96f984b7-5ca5-49a7-96db-9a300a505a09", "comment": "Malware payload (Mirai)", "value": "3aafac6cbcc5236045691f082110fe5c2ff0711f432d2e74205efc42508c2984c24903ddfaf29102170b40d741e2961d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763041, "uuid": "908445cd-6a3e-4186-8b66-2582ecb15fa1", "value": "T14D246D46AA808F13C5D2277AF69F414933329764D3EBB3068D286FB43B8765E4E37605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763041, "uuid": "b30f2296-9441-4274-ba35-212393c5f652", "value": "6144:v09OpWqcBs+en9IaRs4eXnEc1SETc9M/9dfKF/:vUOpJcVk9IaRs4eXnE7ZK/Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763041, "uuid": "53b34a7b-369c-4c06-b416-a7bf34129b12", "value": 214629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763041, "uuid": "f6295361-dc27-4efe-b153-d89ed8a5cb2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763041, "uuid": "76cc371e-858d-4aeb-a8b1-c042a02827a0", "value": "SecuriteInfo.com.Linux.Siggen.9999.9876.22098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aecd6d1-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764770452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770452, "uuid": "bfb0ec2d-1213-4fd1-b744-e75645965028", "comment": "Malware payload (RemcosRAT)", "value": "a129cf94f07d44fc546ee1917e740e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770452, "uuid": "8f701351-b8fa-43e7-a937-94d15e34cf85", "comment": "Malware payload (RemcosRAT)", "value": "6a60df67162c247c7b02056c1c72acc6556d3c01ee01681157a57fc291d0068b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770452, "uuid": "203dfd9b-a5de-48c1-b078-8b3b643c4cca", "comment": "Malware payload (RemcosRAT)", "value": "016f90ce8cd101eed8b5b6d743b0be7bddad0852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770452, "uuid": "67ac9d92-1e7c-4771-9217-5eb5c0d375e3", "comment": "Malware payload (RemcosRAT)", "value": "457cbeb984a1fb95adff2eba63ca817814fe58e9799c93053ff40d1c0d8c6034735f0afc53b38a9747aaf3dd229614a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770452, "uuid": "18e98e6e-fd6f-48a0-be94-9e306352891f", "value": "T16D65F066A1F08436D127CAB48C16D38A642DBEB43E75A8163BDC3F6C9F356752C26073", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770452, "uuid": "94c20a1d-8361-4957-8632-9ba0743b937e", "value": "eb41e5567017c33839f07ebe2eb84cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770452, "uuid": "f0e9d130-3759-4fc9-9c6c-b4238d4337cc", "value": "24576:bbCbz7++IfUFixpw0QB7FqyJgry8OeqXmytZd5xeQqfeWpSHiRTqH:bbiFjbPqyJg+fmQZdveQZWpSGOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770452, "uuid": "852649bf-8984-4dda-88a3-328ae81408b6", "value": 1536000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770452, "uuid": "a8fc2c39-aaa7-46f3-ae7a-a3194008e54e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770452, "uuid": "5b511881-0985-48cd-bbee-8e274145718d", "value": "Payment Notice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8850f3-d017-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746032, "uuid": "42500157-c900-4513-9f21-132ebb2b6bcd", "comment": "Malware payload (RemcosRAT)", "value": "2b770733bea2cd1956d1d9cf08599822", "object_relation": "md5", "Tag": [ { "name": "31agostomax4-dynuddns-com", "colour": "#7DC4D2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746032, "uuid": "af3a58a6-a593-44c4-bafb-e27f9d6e9efe", "comment": "Malware payload (RemcosRAT)", "value": "6a724eb42d810bdcd5ae0ff16c4816072ff5fd54bb4e45e036c10c0e070a4664", "object_relation": "sha256", "Tag": [ { "name": "31agostomax4-dynuddns-com", "colour": "#7DC4D2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746032, "uuid": "3992a728-0350-455e-b480-6b16a8fe2f3e", "comment": "Malware payload (RemcosRAT)", "value": "8a88eefb22a83e3634786710368b5876ca06d8d8", "object_relation": "sha1", "Tag": [ { "name": "31agostomax4-dynuddns-com", "colour": "#7DC4D2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746032, "uuid": "81fdf665-7c2c-478c-a3a1-bd1e22f54094", "comment": "Malware payload (RemcosRAT)", "value": "4db3ff04beb15bbbc8782bac8495ac16373c77b603daca376c3901758093a44762e2e5ca489f0c587304299ffe4d38cc", "object_relation": "sha3-384", "Tag": [ { "name": "31agostomax4-dynuddns-com", "colour": "#7DC4D2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746032, "uuid": "aed2c8ee-9d50-4c7f-acae-38f9f92b225f", "value": "T105163A903E798C0EA67A3A05349D6386993A35BFD4437F04FF88DE36EDD9512CAC4990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746032, "uuid": "977332b8-3034-4722-9181-f2df4897d4f5", "value": "96:lPxOlMilRlbY8X/Q8EsbM9qoIJWpO2CfD7r6/7R8xcjAdjrdpIDfDINu:FoZDNRgmWpdCfD7r6wciTIbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746032, "uuid": "62187c6a-ec76-4659-a39d-dfb6142f1d36", "value": 4353534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746032, "uuid": "b43ab4ed-5636-4daf-a649-e8f30d3d0a04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746032, "uuid": "ba5cd695-c515-4500-a579-30e10792c17a", "value": "6a724eb42d810bdcd5ae0ff16c4816072ff5fd54bb4e45e036c10c0e070a4664.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398875a3-d003-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737271, "uuid": "05d61512-0a28-4a86-a2f5-271af352d13b", "comment": "Malware payload (Mirai)", "value": "78f843372ba7b87d8c3419d96c166b31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737271, "uuid": "3bdf8d0d-a548-4184-82ef-d999c8b23a4d", "comment": "Malware payload (Mirai)", "value": "6c4a1513af8d2c94ae0b6393f4d56d867fe407ce04f64ddb1148c69a50134622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737271, "uuid": "d226747a-0a1d-4cc1-98c2-2e43515e6cb2", "comment": "Malware payload (Mirai)", "value": "4057194a5a2353752a62ba264d6d481e9a2d97f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737271, "uuid": "6ecf6a76-fb12-4903-acaf-d099cca8d4e8", "comment": "Malware payload (Mirai)", "value": "37c6d0b650fdef02ca0c9582eafe2dcc3094bfa1ceeaf6d2ebc5911aaa1d41d2647e2d9c3d4c98ca716755c91cd53002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737271, "uuid": "dd56f4bc-b05d-474d-b7db-82ff476ae856", "value": "T1C103F1F5A487BC16F5F064BCAD64EAC2352A0B79C5ECF1E032005350F5A292CB5FA876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737271, "uuid": "1e2c51a3-b810-406d-bb79-8bef88de7b0f", "value": "768:U2foq9tQAXC9kpLW+PPeE3wB/XeYJvfC1mfVzOFJvs3Uozg:UeZL9t3wQafC160izg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737271, "uuid": "f930a443-a828-44ce-a8e6-4bfba76d97c5", "value": 37904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737271, "uuid": "37540d20-da9c-4af0-83a8-f8357caefa29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737271, "uuid": "0d6cf334-81e4-4ddc-ab6a-64011237a672", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24473389-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746684, "uuid": "43b9f245-f79c-4576-a40b-077b97ddc9ce", "comment": "Malware payload (Mirai)", "value": "9561ef4fe783cc9bafac52ce30bb85e7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746684, "uuid": "951aef8b-3d81-4bc0-8336-d875b109127a", "comment": "Malware payload (Mirai)", "value": "6c6909c66d9ca8f198c199c18b583793347102a3ac0ba030a6716462a37deca3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746684, "uuid": "f22910ac-fca5-400b-b271-073f1311cc79", "comment": "Malware payload (Mirai)", "value": "ba65a60986da055e431ed0f69c2f9676be48f3c0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746684, "uuid": "29fc3d3d-c0b2-4b03-a65f-35819dd7e052", "comment": "Malware payload (Mirai)", "value": "04a55462a458b9c06b60b7f3a6b44cd53e59edc47e0bc5fb3394c6c948f95121debdeaa6e9389296cf093eca224dc317", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746684, "uuid": "0e17087e-2df9-4f52-b3a4-3b7a36c71993", "value": "T1475193CB05CA97F4EDB1589171E948046CC6F697B4C7DE47EAEC24A84C8EE8072D0F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746684, "uuid": "f3ebcc59-454a-4b8c-a534-80f462fba9fa", "value": "24:vSBUgBtUDBKBYhuB7qdB3BLB2BV+BxBNxBAO:vuBtUVWYIkxNKMTZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746684, "uuid": "aa16d2d8-a443-4630-b224-88f52225e762", "value": 2698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746684, "uuid": "d7eccc37-500f-4a53-bf4c-5618cfc045a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746684, "uuid": "6db92cab-f85b-4569-8ae0-2db865333eff", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d82a240-d09a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764802105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802105, "uuid": "c0da8ec7-8793-46ec-97bb-52eb07975ba1", "comment": "Malware payload", "value": "e9246ea292c91d357da0cca690557d9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802105, "uuid": "77a8fe4f-6520-445c-86ba-0ff80082b0d0", "comment": "Malware payload", "value": "6caee8beb73f764aa98384734cd2fe2234148e5e8f4a2cfc6b068327dab27a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802105, "uuid": "9aeafd0e-88da-4101-9894-c388d4d50dc2", "comment": "Malware payload", "value": "c9cb39e535997ca9e45452a405e502351abecdb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802105, "uuid": "fc25a341-3271-41dc-9068-1aa6b3e0aea1", "comment": "Malware payload", "value": "ccdeaf6dba010333a305df7288fb3973490129968e91697da3c0d15da83f0a4247f6642fa6fdd3fdeb3088e38cfabff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802105, "uuid": "352fe693-87bf-423f-92f5-3e90bafa546f", "value": "T126648D5AB7B410FDE177C278C8520506EB76FC56876196CF03A44AA71F236E09E3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802105, "uuid": "7c7e95b9-e2b7-4c65-b1ed-b3ad6d002cfa", "value": "a677bc652bfc65ccd5c99d014a2803ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802105, "uuid": "3cd77d6b-7e72-4c40-a39f-7d77a4a80672", "value": "6144:bm3oREPNNoW/eLBB20s/S1h8MQdSHThbhzb:lRE3orLD2HSX3ESHThbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764802105, "uuid": "b17886b4-6d87-48cc-b8f2-b3900a9c7455", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764802105, "uuid": "246d5b3d-8b41-492c-abe1-3620105b0235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802105, "uuid": "e5d3bd17-9023-4a7f-8f3c-0c31035aab8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bbc91e-d05f-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764776718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764776718, "uuid": "db240376-ad38-4d8e-8707-b6054a5297a3", "comment": "Malware payload (RustyStealer)", "value": "b649c684279994e3cf9dfc764f2f9143", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764776718, "uuid": "6f3cdaee-1aca-4f36-b0c0-73fa97f316e5", "comment": "Malware payload (RustyStealer)", "value": "6cfb17162c83c92f0d81d1299c0abd2ac62c8983c022f03fd36e86a37a6704a1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764776718, "uuid": "2096a115-3638-4cde-ade4-91ad9a0360b4", "comment": "Malware payload (RustyStealer)", "value": "bdfc26cb4e43ffe0009ad37259c7a40ce85277ee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764776718, "uuid": "795ea6f9-a277-445b-869c-c0f16ed2ff78", "comment": "Malware payload (RustyStealer)", "value": "7878f0192c7c275edf220f1c76d97b1f4d969b0985a9188ed1799b55c50bf191b90c87d6ae396af256d8d5a8cc84e5f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764776718, "uuid": "9006b9cf-5258-4111-ac6a-25b9106a1410", "value": "T189B43A47F66152F8D0BBC038875AA12BF97178D9072177EB27941A263F51BE0AE3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764776718, "uuid": "75e3d6aa-2e08-4be0-9370-4509c23e0fed", "value": "cfd40f54079031b551e3b3bcb94f0e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764776718, "uuid": "fb074e73-7f44-45fa-b53c-2f6ba378bf84", "value": "6144:xcLaTe4rAeSDvI2FqD8nqFmcbgNiTMcR/RqMRD/annrqqDLw3p2qP:CLa1nSDw2U9pgNiBR/RqU/mnGqnVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764776718, "uuid": "21317e7a-79bc-46d5-b7ec-238b5482cb2e", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764776718, "uuid": "6281c904-ef91-4903-9d73-58c2c698d9f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764776718, "uuid": "f1f2a04b-fe30-44fc-ae25-4525876a1906", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce08d502-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793784, "uuid": "c7b2cef9-4263-49a7-99e1-df1a84faf110", "comment": "Malware payload (Mirai)", "value": "7a4136e1e207c3e7ab74edd29ecc8a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793784, "uuid": "0957ce75-b88e-47ff-b245-7bc0ab94406b", "comment": "Malware payload (Mirai)", "value": "6e4e797262c80b9117aded5d25ff2752cd83abe631096b66e120cc3599a82e4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793784, "uuid": "bbaac514-3476-41fa-964d-ff07973b18e3", "comment": "Malware payload (Mirai)", "value": "edeebd735ceb52d0114c76b1a5b0b04ccd8c0c13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793784, "uuid": "b5cb1098-49f5-4053-84c2-6856e8f55e08", "comment": "Malware payload (Mirai)", "value": "cf18daaf5cd795c1156b7ce19bb197305afcd7e691d8fd34d3fa5084f53244e3a6323283a3d4d7ce1a70b508b568db5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793784, "uuid": "198aa139-b188-48fc-9c48-4fb4049a1d3f", "value": "T19923F15DDDE8B8D6CD2CB83BA18E5B37FA662285254F04C861360455BFAEF0BB02445F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793784, "uuid": "026d151b-ec53-44d1-900f-4b51a860c3c7", "value": "768:ymvzRsgpylx8BfXAFkt10rtb8IboA3d2WXILZb6x37ZntbemnzKPsdk1vPkWW:ymvFsjcBfPtWBoIzN2WXG6x5KPsO1vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793784, "uuid": "fb1d70a0-1cc0-4949-ad2d-864a5a556ecb", "value": 46468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793784, "uuid": "fe2c5a74-8e54-42ee-99a1-3534ac91d718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793784, "uuid": "0d50f373-747b-41f0-92e6-1cf5eb548e71", "value": "zerobotv9.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd875b3-d083-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764792172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792172, "uuid": "3c231cf3-d8f5-41b1-8b80-e5d1ac15fff7", "comment": "Malware payload (Mirai)", "value": "729a6019b0a44c3e8a516b70fd6463dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792172, "uuid": "afb59ad5-c397-4a6b-bb12-06dc023f88e0", "comment": "Malware payload (Mirai)", "value": "6f200378cceef8c3f9660152043259d4586b8bf8cd01ff965cf29225839d58ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792172, "uuid": "005c3487-1fbe-43dd-a6b9-0b57617a0495", "comment": "Malware payload (Mirai)", "value": "a5cebd0f3439ddb0ae1eb9e6a1a896614e25f2b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792172, "uuid": "99a72bef-d6e8-4c7b-8782-04572aaa07ce", "comment": "Malware payload (Mirai)", "value": "9a2f70a0f6739e4d6bf9de211202378e481129c79fa10e0fd0c41c19f634baeee4da9cb7cb53c97111562e35381df5ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792172, "uuid": "7280aff0-7ed9-4df9-96f1-25b130a4d6fe", "value": "T1A313F1BAA9092A70C3F10534D62DC586C5E30E39B0F8F0397E0E94E927931B767E5B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792172, "uuid": "27e4b4ec-1f72-410d-839f-c85cbe8a2f36", "value": "768:g4pMYWW7zSiQWxyxrpOoG7f5xY8UZz1sQXxUuPQs3UozH:gYJ7mswhpO55pUkKbzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764792172, "uuid": "ea1f3060-de7d-4d7c-9fa0-97a24cb6a114", "value": 43136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764792172, "uuid": "a5411e5d-12c0-407c-8c6d-ab283dd29d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792172, "uuid": "3a789131-65cb-4989-ba95-d49e97efe29e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2737015-d04d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764769257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769257, "uuid": "90fe9be4-94ef-4af3-ab99-f3207417848c", "comment": "Malware payload", "value": "d01406e62d063cb0bb4c5b95d20bf152", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769257, "uuid": "562215b6-ddd5-49e2-bc1f-332e35ac5a3b", "comment": "Malware payload", "value": "6f5e0a787ef15da08fe170df1b9b9dea90d481c09252251c9c10fb65f347fbc3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769257, "uuid": "9ad61704-4220-4488-8c4d-1e58492379e5", "comment": "Malware payload", "value": "21287bfed4d1ffc247067166094499c3d55821e0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769257, "uuid": "4d914238-f934-4b86-b1aa-d0bd1f9f7ef7", "comment": "Malware payload", "value": "7e2ddef610d84804ef7068c4b56546b83c8a662d14d036e3f11e9fc349a730eb52b3af7f6e444dd3dcaa969c8bd460c7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769257, "uuid": "32ee6455-aeee-45ab-84f5-57f35dff0c50", "value": "T1FF36C0B8F48D8CCCE88AC639D67A355E4B0EB10F6ACD3884353D0A55B306694B75379B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769257, "uuid": "404418df-469f-4664-93c1-d65632190722", "value": "24576:B/C/9ZJODwZcV+xhAGd3t7VpHMkhQFr7+Lru8zN4k/uRHRbl7XBEEEulZNJNIw:B/I9cwZw4d97DhQFnI7VGXblVEEEAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769257, "uuid": "696813d5-3770-4bbe-8825-e1f838d55f28", "value": 5243392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769257, "uuid": "a6188ebb-43ca-451c-a962-20fa6f4acc1a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769257, "uuid": "abcf5eae-f3fd-4cef-ae0e-3e5a1a59e233", "value": "6f5e0a787ef15da08fe170df1b9b9dea90d481c09252251c9c10fb65f347fbc3.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13d5cee-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736694, "uuid": "1604fbb3-8880-40ed-8440-3670061b17e6", "comment": "Malware payload (Mirai)", "value": "4fa50f2f111c12179176aeb3e0c903cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736694, "uuid": "c153c324-a3ad-4c7f-aa5a-4e616fa53617", "comment": "Malware payload (Mirai)", "value": "6fe4828720a244e1b4f2ca720b2d4e70fdee761619026ea301713f2507a1aa9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736694, "uuid": "7c87654c-094f-4860-84a2-f2b6c5c9de65", "comment": "Malware payload (Mirai)", "value": "4d7f0347af82b74d31753877c7cdfa1924baad12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736694, "uuid": "fb21ef3f-3810-4fe0-8bd2-777f799e2b05", "comment": "Malware payload (Mirai)", "value": "dc99242237d3a30e0a752b1559298a756a8ffffb9ff0158b0119428ea3ddb967136286092dcd9b5475da43303d1c94aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736694, "uuid": "6497e727-01ab-40ba-b713-eafbd7c8caa6", "value": "T1F97302BF90F1DD8EFC060B34889AE62445457851A5C46A22AD2E34C5BFCDB4460FDEEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736694, "uuid": "888c8b6c-b112-44e1-9e50-1eef4f38e7cc", "value": "1536:AGmdImBbqVIFqRHO8OHBs7Dtfrsa0ToYYDz9C+xbOR8enlR1CWEnkVE5HyvjsteF:JmNbUxuJsFfQaIoYYDZxbOR1z1Cge5Wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736694, "uuid": "24a7e681-8286-4501-b9b1-94fb7114f3ff", "value": 74812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736694, "uuid": "bef7e2cd-d358-4dec-bccc-48e192cc90a6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736694, "uuid": "c47f45a5-c713-44d0-b9de-76c44d35a0ac", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9efc8f-d079-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764787982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787982, "uuid": "fbbcd010-f48b-4e7a-86df-905c141a0725", "comment": "Malware payload (ACRStealer)", "value": "949ce8d74fb987d0d11827a510cc730d", "object_relation": "md5", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787982, "uuid": "a23a00e2-21d8-457f-a2cd-409a6a9a0488", "comment": "Malware payload (ACRStealer)", "value": "70428c1fd7f8879239050155e0a37ed65c6997855e8a8420e2d2f09598ba5cd6", "object_relation": "sha256", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787982, "uuid": "c1e46591-6160-429b-91a2-253d8e1bf82c", "comment": "Malware payload (ACRStealer)", "value": "5bca0d1868bd543d139162003fd5b8f14b57e1e5", "object_relation": "sha1", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787982, "uuid": "65d87af2-90a6-4140-933b-26ccb3b76c48", "comment": "Malware payload (ACRStealer)", "value": "6ed1f6404b0b2521a9d311c76f2fb87c6315c327b76834e718feda5d6b616b32f5e169be969bb94015d16bb2bfb5e1ea", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787982, "uuid": "3694e41e-1245-4d22-855e-8aa4ed575a9b", "value": "T1B2C533269AF89036D97627B045FF07F31A327D3086729E6A7284BE5E0D73258E4343B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787982, "uuid": "5baf04ee-5b53-4d2a-842f-b4ace47ea562", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787982, "uuid": "be01dfd4-e416-4ab5-aea8-9b6aa454942f", "value": "24576:3yqDUun9yPw4pVgFtAV3JhlpSys6pMi1sAF08yY3Ozo5xda7XufoYkhgAY:C0n9yZHg/GZSH6J1TehY3so5xdgCWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764787982, "uuid": "fac3e71d-1342-4066-ba0b-bcb3de51746c", "value": 2630144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764787982, "uuid": "44f1e3c8-0c25-4108-82fc-b9e77e89152d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787982, "uuid": "d8e9fc78-45f2-46a5-ac34-8836ed80dfcf", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddaff55-d083-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764792200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792200, "uuid": "3247ff05-5093-45fe-9903-a61fc22f5bec", "comment": "Malware payload (Mirai)", "value": "5f2976dbf7da04c31f827fa635d8fe41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792200, "uuid": "5255c8d3-dd62-4f54-acd6-4b7331d99f57", "comment": "Malware payload (Mirai)", "value": "708722783217cdba34f377d1af37d72671683563eda9cade928862d76a5b5a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792200, "uuid": "aa72bbee-48e7-4519-bfcd-286da2213d5a", "comment": "Malware payload (Mirai)", "value": "92e90eb9aeeab1ca20871687c1406c43cf25a94b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792200, "uuid": "08d93639-7d71-4009-819c-254232569d4d", "comment": "Malware payload (Mirai)", "value": "6b6d988622dbd28b1b98896a61a369ac4b600429bff20eebd376cee5d6802b4c757178bf6ff5e85c344cc6c2d829ad61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792200, "uuid": "53eedf21-1d8d-4b4c-b397-4f477efe8ad4", "value": "T184932951FD825613C6D122BBFA6E428D3B2653E8E2EA7203DD205F2177C681F0D77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792200, "uuid": "d3adc44d-dfc2-4bef-932c-f23c0fa9dbf0", "value": "1536:FWKfB7ByQgaFrrjwg3ZxOb7uf2wOUM9ASbqiO2C/mRrEqyXvro:oKfB7Zr7C7sOUM95oqMro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764792200, "uuid": "fa93c7a3-945e-4eb4-b957-871ff2976964", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764792200, "uuid": "5576c2da-8275-4b2c-afae-d794cecf4d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792200, "uuid": "0bdfc11a-c2f9-4b2e-8e48-1456f2de260d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9f4faf-d039-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764760389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760389, "uuid": "06222327-eaaa-4dc4-874c-290c0711fcb9", "comment": "Malware payload", "value": "4ad4c6f214ca36d2e1eeb0d48120c20e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760389, "uuid": "eddf3a95-e387-48f0-b61f-2221e409db25", "comment": "Malware payload", "value": "7089a88a91280a6c88f2984e995597b2c09f95f12f6ca740c3352c784e01a34f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760389, "uuid": "3fdcb538-0a64-4372-85a2-8ebae1b09e1d", "comment": "Malware payload", "value": "c4b2233954db68bfca91d4ed5b5a403a9d295fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760389, "uuid": "c6341b7a-fff7-46cf-862f-df28662540fd", "comment": "Malware payload", "value": "0778c5cff820f3156a88aea914050812d7ed2c77b7517dff9ce5440e8d45679f5254f32e29ae3c8ca5b634ba3522dab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760389, "uuid": "943a558a-3265-44b5-a2c1-4051604c9f8b", "value": "T100947DBC6E899C63C7ED9B75C196B17AE730D1F70403631F254449CA4CA1AD1EB3AA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760389, "uuid": "1171bff7-8cbf-48a4-8a91-b89058194688", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760389, "uuid": "ca925421-7f05-47e3-aa4a-8c0fd0c0990a", "value": "6144:Tj+VnrXFWHJfURPNoas4CGJbrLa271MPeuOiLtjzkbGEwia5:TjY+kNoatXI2xMLOi7Ewf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764760389, "uuid": "7ea4742e-5e03-4d20-892f-416d81f9ccd4", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764760389, "uuid": "85dbafcb-63d2-4b68-8e7b-da41bf178cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760389, "uuid": "b798809a-6b39-4d69-9391-a16548d41d0f", "value": "7089a88a91280a6c88f2984e995597b2c09f95f12f6ca740c3352c784e01a34f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f606a18-cff1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764729523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764729523, "uuid": "babe5863-ec5c-4af5-a37e-b72435f70d8d", "comment": "Malware payload (Mirai)", "value": "227a9636b707fdb61471be6fcf395a22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764729523, "uuid": "c3f7d5ec-06e9-4c90-ba5f-ff2a44226d90", "comment": "Malware payload (Mirai)", "value": "711b890873df3573927acfd309bd85e5506fb68a282e5cfc29f59d467e50986d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764729523, "uuid": "80802c01-8922-4978-ac28-955897c7b2f2", "comment": "Malware payload (Mirai)", "value": "c6bf01bdab113184328c520cf675a7c9178b7c03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764729523, "uuid": "923442a5-5980-4ef1-9d59-4c621db45f23", "comment": "Malware payload (Mirai)", "value": "cc91bf410e65ebfcce608007179bb7c06b5977a6c2259ce394fc4903295ec8de7bf5dd9f5357cb91eaf56d27fed4ac0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764729523, "uuid": "2544419a-65a6-4519-93e5-882ef07936c2", "value": "T11B03E1A3B42FE6FCC227B4B2A8075B49FB92E8170A120F3B4965706D1E5B59D2035F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764729523, "uuid": "241c067b-aea1-4a73-bd87-2acb0f2d6459", "value": "768:iBLmmOT6+wNB//myK0gXWx+9sI0OSFmeBjVNDxv81n4+WfA41Ck82NHYlx09q:wtOT63NB3m26xu5OSFmeBedWDCkdUcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764729523, "uuid": "5448dc82-a081-4c2d-b66b-a7fe167eceb7", "value": 39248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764729523, "uuid": "cbeaee35-30c4-454c-be89-1f814068daaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764729523, "uuid": "202b9907-a561-4dc5-9a99-b2e4720a3e78", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27664bcc-d008-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739388, "uuid": "c5f94f8d-bcdc-4cf3-82af-21d73c7abb43", "comment": "Malware payload (Mirai)", "value": "97b148911789fc90ef56220acb110fc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739388, "uuid": "66a129f4-8c5f-44f0-b948-43b9e7f8cd3b", "comment": "Malware payload (Mirai)", "value": "7146976b9d57b28c612bbd667a89895ee9a67dabefc88eb7df149955e3c1b77e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739388, "uuid": "9279845d-b820-49c5-ab82-ecd921b4efcb", "comment": "Malware payload (Mirai)", "value": "cd5d96d9caf8bbf402769743d9cdf6c11c4cc4eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739388, "uuid": "9dfd23a9-1b25-4cfc-93cb-60d63fa2bebc", "comment": "Malware payload (Mirai)", "value": "000ed09456c2fc38315c52857f3ddc9f609ad199c12a46fb3f82c8450ac5f5ac02f6cc35c44a846ee6405d26ca32f6bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739388, "uuid": "6136c42e-0d07-4530-b667-9b839daed734", "value": "T12B831225DA32F5B3ECA98E354AFE965F46B02904D1BE31AACE0341588DC648137BD64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739388, "uuid": "23f041db-d2d1-4ea7-8d7e-895bdb413ec2", "value": "1536:WvjosfpexKrtBOQZg978TuCKKiejR+XSiQvOy69BDN4/uz6:Wb/fRriQgguCHFnv36nDMuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739388, "uuid": "31fd7ba9-7beb-4e9a-b084-6a96b5043f7b", "value": 82912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739388, "uuid": "162009ef-3a76-403b-b458-db66e10caa3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739388, "uuid": "e57fb881-dca3-4a3c-8f3c-e12a8a3ce7dd", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089d18fd-d044-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764765106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765106, "uuid": "d7afe68d-1d4e-49a8-b817-0c667234c746", "comment": "Malware payload (Vidar)", "value": "9d00bc60cd4ffa07d9cb3c44741de82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765106, "uuid": "3fff9ab0-2c2e-4af7-8e9b-9583ed8817ad", "comment": "Malware payload (Vidar)", "value": "71aac2222c0e1fe73a2cf76b28c77b1383b7e4f9b7cd7795b75691c094185681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765106, "uuid": "1e235b28-fb79-4e28-b43c-b0e7819e2ddf", "comment": "Malware payload (Vidar)", "value": "234398875991dce35f8f28f64a9741428a0dbef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765106, "uuid": "1eacbcf2-c34e-48c2-8c8e-e5be6a165c19", "comment": "Malware payload (Vidar)", "value": "855628f57ed0a6fc5ba5592644ffa76a4eac9c6a9a98ab57d383cc4947bbf0070e38380930051e8090d59793ac453c2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765106, "uuid": "61002993-6f94-42bc-9767-9ff903b600cb", "value": "T148E623DBE4D822E4C8974F70A75F13CD33E0B1568C67A62E33C62D029D31EA75646A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765106, "uuid": "f5308011-6d9f-404f-b4bb-7b1f57912670", "value": "663db01aac141130c0fe8631c0bf50ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765106, "uuid": "23397f68-fc77-46e7-81ee-d3ce68e68bf2", "value": "196608:Ejg9G6s2Xt3MWHCmNkvSFTdsg7b5GRhW6IhD51ouw160ptl31nUKv7sUEUneOJ2o:Ej4zt3avqsg7bnhD512XdEqzIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764765106, "uuid": "942eb883-02f0-4686-ab84-b193a12a9b4a", "value": 14459904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764765106, "uuid": "31277dab-8fc7-433e-a963-dd557d5c532a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765106, "uuid": "7659ffc8-cb1a-4b1f-aa97-7413c5cd6790", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a06619c-d002-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736762, "uuid": "44a7d0c7-fb42-4c53-9ecc-c471f4e18336", "comment": "Malware payload (Mirai)", "value": "98a7131ee33528384a7d1705857175d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736762, "uuid": "0fb4633d-e268-4ec4-8a06-69018eba3218", "comment": "Malware payload (Mirai)", "value": "71f4d7529caeb4cea529c21b25700be600e53923c126a7666fbe0b7f7a3ce0e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736762, "uuid": "2c78be54-e5ec-444e-abf9-8f684653c43b", "comment": "Malware payload (Mirai)", "value": "9e32b4c82cfef722b8c94bebaed32595cb400d50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736762, "uuid": "54e70b76-ed1f-4914-9457-b2780f479165", "comment": "Malware payload (Mirai)", "value": "160c85bfedc949a86e34993ba863aec7b68f9e0055995a01e027795768292377fb54633a584f2f1750ed57e6933e0e0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736762, "uuid": "895fdf96-de58-4995-b16b-ff6270abe2ed", "value": "T16264F70AAB210FFBE86BCD3B02ED1B4529DD645B21982B353274D818F54B54B5AF3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736762, "uuid": "4ceb57dd-973e-4198-ab1f-4021828d6200", "value": "6144:ACUdwWBdg+R5uT06a97+KVMi76Vt+ie+Q6EmuzcP9EhU+0J:ACDuh7t6EFcP93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736762, "uuid": "f11d4208-e182-49ee-bfb2-f0377e2387a1", "value": 336152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736762, "uuid": "63705086-c5c4-425e-ac36-077302c6da54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736762, "uuid": "e7d15111-5cdc-4bff-88ec-77a1610365fc", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a6d072-d017-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764746101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746101, "uuid": "a27d97d9-8704-4cd6-a216-2f906b4735eb", "comment": "Malware payload", "value": "aafb1d00f9072fc4a2777cbd7153e534", "object_relation": "md5", "Tag": [ { "name": "31agostomax3-dynuddns-net", "colour": "#45B74D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746101, "uuid": "3af67b3e-bba2-462f-8238-fb6c9b168cae", "comment": "Malware payload", "value": "71fc5b649c4ca8ada3d1b6cfdcc52337504238fcc4a705d967f6a4e54b49d4d5", "object_relation": "sha256", "Tag": [ { "name": "31agostomax3-dynuddns-net", "colour": "#45B74D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746101, "uuid": "abc6963c-02c1-4fd2-a41c-043863429bd3", "comment": "Malware payload", "value": "abcc622f66521c811c7e9e69fd964ece2e4e7aff", "object_relation": "sha1", "Tag": [ { "name": "31agostomax3-dynuddns-net", "colour": "#45B74D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746101, "uuid": "f7f40040-7a2a-4147-9317-67be06c55ccc", "comment": "Malware payload", "value": "e95451c85f1dd864fb872f60e52708ad01500e4a889f1e1df9fc612e5acde8a1fd717b6ca49c3b4c6db380cc2f53c06c", "object_relation": "sha3-384", "Tag": [ { "name": "31agostomax3-dynuddns-net", "colour": "#45B74D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746101, "uuid": "c5e172a4-8d23-45af-bf6e-dcf4ac3b8691", "value": "T195164B0FF06C84403AE3091268A669778EA76DD694BC5AFF624141CCDC28B98DDCFF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746101, "uuid": "73fc01cf-5dd8-4113-9304-bf2c340b7020", "value": "96:lel4l4l4l4l4l4l4l4l4l4l4l4l4l4l4l4l4l4vel4l4l4l4l4l4l4l4l4l4l4lV:Vt9dObS7XWYzr7Gjr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746101, "uuid": "80313bdb-1370-429a-879b-8603a1deb8cf", "value": 4353004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746101, "uuid": "f228bca0-4abf-47c4-b578-ce71f895d513", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746101, "uuid": "4649e885-87ba-46cd-af7c-6478f90e1100", "value": "71fc5b649c4ca8ada3d1b6cfdcc52337504238fcc4a705d967f6a4e54b49d4d5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2268bbcd-d09a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764802086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802086, "uuid": "1a98fa07-9fb6-42be-8051-434bb2b6e0d8", "comment": "Malware payload", "value": "c2c331d41e7d6963fc30083a5a95a468", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802086, "uuid": "0711e93c-8419-497a-839d-a11c5533b262", "comment": "Malware payload", "value": "727ef8598990483205600a38a67ccebea5d9926b9f8312fffaf4e72c6990a933", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802086, "uuid": "1d619bd7-5a0f-4596-8175-de931c4105c1", "comment": "Malware payload", "value": "7e0b408dc3636cbcd33e1790dcc3b60063e52e9e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802086, "uuid": "14752009-65bb-4319-b14d-61738504c70a", "comment": "Malware payload", "value": "5163681eaa31cc2132faa69293526bc3e6c16bb6cea59427a6662333b1423ba095beacc985384a0164ea2e748a7e03c2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802086, "uuid": "ca8d6dbc-7157-4710-9708-8d04d23e5ae5", "value": "T1CED31277DE318FBCCE69A5BF0D2424943BC66A29D2652047096FA0B32CF1E88B1741F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802086, "uuid": "3fad94d5-ef87-4242-b6f0-6ecf4e4b0b30", "value": "dbf8e107a6bcc0ba765755e73d7a979d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802086, "uuid": "30f699bd-e679-46e2-8080-e2328a738d03", "value": "3072:ZwRRJe0CqxMx+O4kx0NffQutaUS7arLkXG:exMwTkIXQutaUSesW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764802086, "uuid": "c28a52bc-6d94-4ab3-bbac-abaff71972cd", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764802086, "uuid": "81f87650-bd7d-4e60-a095-a692679f643b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802086, "uuid": "57a0c7ae-865d-4f60-ad56-74ed7757c501", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7143cbc3-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746814, "uuid": "c696a41e-dd5d-4f80-a770-1c8803ab3a69", "comment": "Malware payload (Mirai)", "value": "c0b673eebfa782f91a986f7d0dc518d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746814, "uuid": "3cc40999-8070-44bb-8ef7-a45667bbad1b", "comment": "Malware payload (Mirai)", "value": "72b307a2d81e94f93e41c15f04a62d4d84a76d2d3b807ed76db9b533b41bd4c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746814, "uuid": "3a8c5cca-ac21-4132-82a2-58fac00d5512", "comment": "Malware payload (Mirai)", "value": "d431b7b7d4f6bba738a22a22e5e92c7a07c3ac67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746814, "uuid": "83e88c5e-a9d6-4383-a88c-299a2d3a9c08", "comment": "Malware payload (Mirai)", "value": "c76d0296f8cc7124057ee6ffd0c4e2d8f74a51c871ae9e9c8109f5d65a7777af6c5579e72fd090614d8300252d9482d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746814, "uuid": "17674d8d-2c65-4edf-9291-0bd71185db70", "value": "T100630263E9802C71D6F78EF6F66F42832B485BCAE05A73A9F264E75408C311C73DA855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746814, "uuid": "bfbd7c3e-bafd-43f6-8ac9-abf53481b062", "value": "1536:jxjs6OKWJ0X8b6bw19jE6kRT6UMbZVxvRHM7lzhykg:NshKWJzb19jE6QBMFVhtig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746814, "uuid": "a8d29e1c-adf3-463c-8a91-d017cb0b6668", "value": 71492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746814, "uuid": "1835c2c5-ea25-44db-ac21-db5986a1efa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746814, "uuid": "411e14ca-5f0f-4997-a0f2-3d83e1513ef9", "value": "Yboats.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58b68ed-d029-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764753908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764753908, "uuid": "a1a75e12-6f5d-4945-b227-1b787ed6baf4", "comment": "Malware payload (Mirai)", "value": "c8d4303d25fca7c7eaecb0dc879163cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764753908, "uuid": "d96fc1f8-73ee-4ea6-b746-11a47ba0eaea", "comment": "Malware payload (Mirai)", "value": "73bfc9d438cd3c35d35a508c7ccb3e8c6683a9368b0daeb73ca9c4cc721b3270", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764753908, "uuid": "8e0d1307-776f-403c-9c1e-edd9a4251723", "comment": "Malware payload (Mirai)", "value": "7bf0a2273202015df2867897467bd4a150fff714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764753908, "uuid": "0784069f-8840-4f38-8024-52855b9cc08b", "comment": "Malware payload (Mirai)", "value": "1c31322197f7dedbc803d209e7a61ecdd1ae6fee6e0551314516867eeef52f4bde82c95eba5eb30f039560201f74e219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764753908, "uuid": "69a2875b-fc02-4f41-ba37-fab5c6f3b071", "value": "T171E3E81AE7614FBCF25C867157739A609A48139713E7E281F5ACC900AE7074E682FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764753908, "uuid": "0b62ee2b-c81a-4c26-adc3-3c53b2fe4f82", "value": "1536:0rwLSpZwWF7rKcQUnlDdW9eamfr/p1dFtVXl3H/9ljXNDB1PJRnsj9hbbrXvJdzx:xQFHrDn/JGQnFP/be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764753908, "uuid": "7cb46a62-11fe-4e79-8b55-6345782799cf", "value": 148916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764753908, "uuid": "d90ed211-53ec-4c12-9e1e-0c78362b0a89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764753908, "uuid": "075ed6d4-0c62-4a51-bda8-5a4ce07e25d1", "value": "b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30402db-d07c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764789417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789417, "uuid": "6aa48e13-8013-405d-b2da-566593814fc7", "comment": "Malware payload (RemcosRAT)", "value": "0c561e7af970d05e1bcf0f69a9697c18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789417, "uuid": "ac486802-1f15-44bf-8992-3bb76acad490", "comment": "Malware payload (RemcosRAT)", "value": "7409420f04ae9213d82a3d75a567aec2edb0e776dbf494d61b61470dcf45a711", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789417, "uuid": "52da6cdd-9e46-4a2e-b190-614657c6546b", "comment": "Malware payload (RemcosRAT)", "value": "13f796f2888bab272ee49e0e9d49c93ca600288e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789417, "uuid": "1669bb52-c444-42f0-aa42-1a6341a833e5", "comment": "Malware payload (RemcosRAT)", "value": "29f8e2119dd345663aa1241978165b7cc2c314a75a6a4eec09c8844bbb045c4b18312ede726500d068a19bb2c48e6469", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789417, "uuid": "d6e425cb-e3a4-443b-8435-e793b0d2affe", "value": "T170F23ECA3FC6B57D93623063343F909BF12EDE947208845AD2579DEAB92C318E13599C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789417, "uuid": "1e3ff90a-d256-4f7d-b7b8-d2f85395baa5", "value": "384:/SrIdl0s4N235Tjc9iSPpLjfhVpR020QiBZ1PsYgpOQ7JPaq8GjonFd9Xqm+hTia:Tlx4N5koV9F/iB4TonXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789417, "uuid": "d44738e4-a828-4b65-b4b3-a9370c740164", "value": 35069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789417, "uuid": "f9f45c57-a299-4c2d-8c1d-8f7e7fafa91d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789417, "uuid": "4226933f-4470-41b0-aa51-a04db5cff394", "value": "enquiry- 1- 616195SFMS 2025 RFQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca0ad20-d011-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743477, "uuid": "38a2eb44-9799-4ae9-a29f-438d8d709614", "comment": "Malware payload (Mirai)", "value": "b86b515665d39faeec4d79c93973045a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743477, "uuid": "85a9f54b-369a-4709-a46e-891488c3fdfc", "comment": "Malware payload (Mirai)", "value": "741db456f0f376864e8aa36d1cea6925a313a6df245d28240d884c4c7c4cafc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743477, "uuid": "e62b4718-1834-454f-ac38-eb6d7bdd077e", "comment": "Malware payload (Mirai)", "value": "97f96720bdce2ad87e2fb50c174700b7c8ded41e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743477, "uuid": "86a09ec0-bde9-4123-a0c9-6a625dacb0f5", "comment": "Malware payload (Mirai)", "value": "a757efdb3fee1d5c451e015074f80ed58fcab190aafdd24a572ca4194e8ba14f8701615b5d84df53fabc6be4650f401f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743477, "uuid": "e0a25b4f-fd30-4668-8d9b-b6685e867c0d", "value": "T127E3C50D6E359F7CFBA982344BB78E26964933D727D1C595D1ACEA011E2024F241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743477, "uuid": "5fbccb82-e38d-4b19-b411-4d44e8aadac3", "value": "3072:dwkpUVzmKEZNEwky01WRWfmhSc09UqIp0QDXZ1HH7eC8f5nxU5W53vccVd+q4p5p:dwFVzmKEZNEwky01WRWfmhSc09UqIp0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743477, "uuid": "9611f5b8-1f37-4947-9c32-0a5ff0340f42", "value": 153064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743477, "uuid": "6bfc2618-d08b-4ae6-89ae-cfeeed5fe34b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743477, "uuid": "eae7a233-323c-43b9-a43d-60715888eeb0", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cd9ba0-d094-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764799460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799460, "uuid": "25c043a9-9e30-4a7d-9b2b-f74d2d69abf7", "comment": "Malware payload (Mirai)", "value": "e7cd714715a6b48f91f532a283bf85a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799460, "uuid": "2556b143-126a-47ab-8fe3-705a9fddf205", "comment": "Malware payload (Mirai)", "value": "74cef7e79774a79600a6432d12c0a38a9d9c84aa3fc9983311a4f451b5c6fe59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799460, "uuid": "a0fbf194-6298-4a14-870f-daf01bbc1f28", "comment": "Malware payload (Mirai)", "value": "495b12c825068845c93e9f5d2f782e81e7c41c71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799460, "uuid": "ca76ee7d-caa2-466c-9fbc-203d5b924700", "comment": "Malware payload (Mirai)", "value": "dff5fcd45655f3f203559e10f664a5923c80fc6e9470ba0e27f96e268c329173a4df4949d57ced26cd48c4fa5c8346b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799460, "uuid": "1a836e33-1c9b-468d-9ab7-08012cbf45e6", "value": "T17AB34A0177180F47C1930AB02E3E1BE687FAE9E122E4FA89554FD74A4275E37154AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799460, "uuid": "36e14c9d-9e2b-454d-9dc6-0343926bdee2", "value": "1536:Q+pox9sezjXN/D0gfmh5xjZiCa7IpQ8iRGKDsaWBim7e/C8HoyEaEnJnl:Qwogayh5x07E0Rzk70Cxy3gJnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764799460, "uuid": "276c34d6-ad66-41f1-81d0-b63eb1acee7b", "value": 116492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764799460, "uuid": "7cec68e7-a703-422c-b545-2c7fad820a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799460, "uuid": "77dac014-7a3d-48db-bb4c-96d46b26dd55", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6de084-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793840, "uuid": "b9060d37-a59d-4264-b78a-325df4a284d3", "comment": "Malware payload (Mirai)", "value": "59a59574123b9851081e0a43a5c64eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793840, "uuid": "883bf840-6762-41b4-bd90-0e9e41d4cb06", "comment": "Malware payload (Mirai)", "value": "75a0059a32196c07a6d77e22e3d9ad38c9002e7719aa7bf978632e9ba9089d5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793840, "uuid": "f5f23c93-e78d-40b5-ba4b-29e88aff3c38", "comment": "Malware payload (Mirai)", "value": "e5e242ec8321a00065ee8e6c8346b66c7e96f28e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793840, "uuid": "94af884f-6d1a-4841-9b41-dbae192ec949", "comment": "Malware payload (Mirai)", "value": "5cf7d4a8b26eeffd0037df62d2cc1dfed3c7589e9bb272d4d8708577147cef10498d6979b1e31c379e66dca33e89f381", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793840, "uuid": "4f439679-775f-48d0-946d-f7ab4f0f8a64", "value": "T179836CD4EA83D4F5E81209351077FB7BAA72E53E3129EB83C3A9A5BA9C025C1D41735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793840, "uuid": "62e862d1-410b-496e-bfc3-7e5f8f135115", "value": "1536:vLRLOdqntqoSTBVdh9oNtqbQ9eDRtEB324licSeZ2:zNOGqoS1Ph9oXqYe3E3xZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793840, "uuid": "bffd5c57-957b-40db-879f-fe332eac1820", "value": 83540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793840, "uuid": "05cb8ce3-51d4-4776-a36a-7b91f4888219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793840, "uuid": "da2951a9-0aed-4da5-9fc3-138ef07a198c", "value": "zerobotv9.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51dfe5d-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749478, "uuid": "af7d08c4-36ee-4504-a379-07c9f9d2ea6f", "comment": "Malware payload", "value": "88320f095894d571e5015d32846d8cc5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749478, "uuid": "1deef8b8-66c8-44e7-85d6-d2d51b1cbd6e", "comment": "Malware payload", "value": "75b4d9eb26ed9e20009c9a55a58e66457d7ec4d7d060179f09f6522e96c62e2e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749478, "uuid": "d0dabeab-f723-424f-924b-f5cee03cbb8f", "comment": "Malware payload", "value": "eda2bf70e495f84311a476975eddba1e48a6da4e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749478, "uuid": "132bf5be-53e6-43ac-98ef-2b6341f44037", "comment": "Malware payload", "value": "639462e418e14d25f96bcb83b3fbf0880820df26737f9aa7e7d75a52436009168a89bbfffe971236ae3b53922ad451ac", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749478, "uuid": "6398ff9b-2250-45b2-a60e-fe9240cc4865", "value": "T1B2761203F78E492ECDE2B978199713716A15ACEC2910928F4D02F218BEB72D95F25FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749478, "uuid": "591ca040-db59-4125-850e-e3fa486ac970", "value": "196608:whNQnARRU5BQ13O3eFgBi9LLkvWdwHnexU:wh5MuSQ9LYvmwHexU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749478, "uuid": "eddd46c5-7ae4-460e-8a1d-b824ceb9c9c3", "value": 7525641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749478, "uuid": "1ad58b5c-bbe1-4640-b6ad-65683f8cda61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749478, "uuid": "fa884ba8-39df-42f2-bc43-3f91c9c65d98", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5cf2b3-d053-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764771584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771584, "uuid": "78e6c39e-4281-40c4-98f5-f46472af0e8f", "comment": "Malware payload", "value": "16fa8098c7a9229e73b08dfc77eca0f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771584, "uuid": "c38237ad-5e1e-41d0-b23e-a07e9472d231", "comment": "Malware payload", "value": "762c29c0f742ccce301eea56b6ee85e150cc6bdf173e21ff2e82c8e2ae832635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771584, "uuid": "e761bf1e-7bdc-4804-b565-0f9e1d1c1f0f", "comment": "Malware payload", "value": "3812becb2191195b0c975172a239d9e59a1ffd44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771584, "uuid": "90889f30-522d-4f60-a063-c25b15bfed6c", "comment": "Malware payload", "value": "b7840eb3610a5b4319fe79defe517ea723bbdbee12043e16c500d8baabc0cf2ca1e177a14d8bdea4db47f4992279827f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771584, "uuid": "701e45ea-d53b-4fca-91c1-2ab7a8dde4e6", "value": "T104C22849799CC619D67F4B7CB5B303200332A30A1117EB85BDCC49AE2F6376549A13EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771584, "uuid": "377a7e58-b867-4813-a145-e9cad0e1a92c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771584, "uuid": "43dcb6e2-70f5-4820-b306-e39496573a02", "value": "384:yxysR3YvGLki+kVaukO/1QP77HqiEhwTcSTW4gCwL1sb+PiGkOigVj+:ywdkIukPqiEhwFIv1sbJvg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764771584, "uuid": "e110f4e4-427f-4173-9b3b-036e77351644", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764771584, "uuid": "860985cf-1834-4720-95c1-ac8c2981f237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771584, "uuid": "b7c66e8b-1253-4cff-b9b2-479edd28ffb3", "value": "762c29c0f742ccce301eea56b6ee85e150cc6bdf173e21ff2e82c8e2ae832635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a5d9fa-d091-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764798332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798332, "uuid": "7044d690-4ddf-4c55-a18a-ebb3075f8fb8", "comment": "Malware payload (Mirai)", "value": "7ebf88df55706b4fe32cfcc0cce3e492", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798332, "uuid": "db784969-c038-4874-b14a-853bf1ebb4b7", "comment": "Malware payload (Mirai)", "value": "7660ca8b2ceb89b5d6cb3a3e032600cc117d20faf260950c77b14b223945b2ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798332, "uuid": "cdb16454-b06d-4b74-994d-fa762c7fdd69", "comment": "Malware payload (Mirai)", "value": "5364cea3346a3fbea2357daae94f96cce531822e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798332, "uuid": "6ca37df2-bd08-41c3-a57b-64501760ff42", "comment": "Malware payload (Mirai)", "value": "6d28b37b785848ea6b5b94b22704f0a1366e34aaba74eadcd1898ae51fa2c4f4b60b5380ff5fcbf2a236d393d25d50ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798332, "uuid": "ecc2297a-9877-4a34-8da8-ea9ea3c74b05", "value": "T121B32A80F68B81FAC84B883060A6F63FDB31D9E94173CA5DEF999F32DA37941911164D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798332, "uuid": "c3482b5c-2c29-4561-b3a3-76d1cd024559", "value": "3072:EkfZVtG90PZAMi5TjRgFydm5Y82NAfh0Gsila1CPjiXR8:LvG90PZcBVgMdTXNAfhEguXR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798332, "uuid": "d18d936e-2ad1-43db-a7f3-ab8f92925355", "value": 116624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798332, "uuid": "296f0df0-e2d8-4f01-bc67-de2851b2a363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798332, "uuid": "2848600a-287e-430e-87f7-5fd638133cb8", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4e49fb-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764770002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770002, "uuid": "c5217af8-2a6e-4172-9586-e53bb3aab349", "comment": "Malware payload (SalatStealer)", "value": "8ccb9a3bf5dbc2e80fd6baf7f0a2f321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770002, "uuid": "268c71a3-9dfd-46da-93ce-aadc58f05bfa", "comment": "Malware payload (SalatStealer)", "value": "76ab981b7b93f61673b2b4a7c12f7ed2ceeeafde66e3c4fce88ce54b4d0c17e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770002, "uuid": "de37ff19-bf4e-43b6-b3d4-fc6945023a66", "comment": "Malware payload (SalatStealer)", "value": "3cf8ff06e7a4aa0aa24d90631bd8949b83971113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770002, "uuid": "930037e0-c01e-4abd-a7d3-9270c545291f", "comment": "Malware payload (SalatStealer)", "value": "be5e7f4259cb9abcc114905d27dc41c6fc13dd36afc525438d6a2aa80c3c3dd812a5c88ae54e74ce8832d660c8eea4d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770002, "uuid": "d03f8a84-9efe-4e48-b8ad-af1bf1de962b", "value": "T182C69E45FE9740F4FD034875611F773F9632260A9728DEDFEAA02E0AE927792193E109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770002, "uuid": "c8e7c0e9-ecf1-4642-b61a-5acd1586fdb8", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770002, "uuid": "b9391f42-79b5-41e9-a450-584ae0ed4db2", "value": "98304:MC70l0xH2VLACpFhhWRz8Xcp64ZEhI1cMmWFxpVVhkkS9V0:2O2uUWe66bqLfxHVhAL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770002, "uuid": "9949e349-9fe6-4dd0-8829-de20e7575eff", "value": 12107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770002, "uuid": "e1519c07-e3eb-455f-b795-69aa7f56c244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770002, "uuid": "964fdd60-38e0-4470-b21b-c77bf01e8612", "value": "8ccb9a3bf5dbc2e80fd6baf7f0a2f321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97605be2-d07a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764788539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788539, "uuid": "82da1536-f251-44ce-8449-3e2c94857c26", "comment": "Malware payload", "value": "68d1fef81d6af5ff55559e05e43d44bd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788539, "uuid": "1ca949a1-09db-417c-a51d-ed419c335247", "comment": "Malware payload", "value": "77628bc6f5e609a95f6c8ef129e262babb232d30f5e478d06432b6553859208e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788539, "uuid": "a75df913-61c2-4be7-95f3-2105502b2946", "comment": "Malware payload", "value": "849604a2fa79967a73c8e8e6f48af1f0e2d82171", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788539, "uuid": "eaa13d7d-a584-4381-8343-33da4c35e31a", "comment": "Malware payload", "value": "9b46b274267985e794e967e9e9c4321c952dcbde9a9b5902b2bd2d6dd2c5c5b315161841800940375829c00b4a62c47b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788539, "uuid": "1fb11f34-fcd1-4a25-9051-9b138854e287", "value": "T16EC36B5B73A431F8E1768239C4910B15EBB6B87507609FEF07A046561F236E4CD3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788539, "uuid": "b43436fc-0feb-4b19-8497-009d0ecefe2f", "value": "b7d8d6b6fc95588fa54d082337cb1cd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788539, "uuid": "9ac2d5ad-484e-4771-91e6-af806d1fc665", "value": "1536:3tRx63PZ28NYnvlfalnJLqIyLE3mFScZolT1+jlvsrzIpsWTgdn9dllhswKtb9:3tvkZA8BOLE30VZ61+jRysPKHdswKtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788539, "uuid": "07c9652a-91a6-4470-9354-d5214812ad3e", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788539, "uuid": "c435b423-839b-4e51-b02d-2dad21c9288b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788539, "uuid": "92ba2a48-cd80-48eb-968b-587b5ca1c279", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604d6c33-d08c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764796177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796177, "uuid": "e8ef9bf2-5c42-4f16-8d23-7db96df7ccab", "comment": "Malware payload", "value": "460005a17d1c8aed410d70687515da1d", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796177, "uuid": "e50fe210-882c-47bc-9a50-f7d4d693e397", "comment": "Malware payload", "value": "77a0536625b25d776fcff8169a2cf23bbc61c8c01d931e2ccd12fe5d6e7a99da", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796177, "uuid": "55bc3980-3b09-404a-b7a9-d425f00e5585", "comment": "Malware payload", "value": "fbbf78dcf41db43b931736abbf97d84d7b007592", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796177, "uuid": "35c991b1-a990-4440-aa9e-247e4d297f88", "comment": "Malware payload", "value": "239df9cc403f14eff35c4510fc4d9557f905909b078116240159dd93d140328b3dfaa683b3a73f4a3e894c2031db54a1", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796177, "uuid": "68fb875b-a425-47d3-bbe7-03363a38a191", "value": "T188F5338622DF7ED7E9B691EB640EE990328E6DDAB0011D0C31430B465EB77A37F19523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796177, "uuid": "0c4d9aa3-ad54-4f19-ad92-34eef83e424f", "value": "98304:oRWwmcUJL44k7wlVIrhIAEIvgAievGBAgZsp:oMwMLdkE2rhHEIuevGBAgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764796177, "uuid": "6d7441e9-c41e-47f3-9423-be18459f40ae", "value": 3572118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764796177, "uuid": "b16608f5-01e6-4119-bd5f-e180426498b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796177, "uuid": "30bbbfd9-e033-4227-b831-f4bc40a18bd6", "value": "hlc13h.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be659a61-d016-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764745655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745655, "uuid": "67fd9e3f-5a11-4667-a41e-d63ebdb69712", "comment": "Malware payload (AsyncRAT)", "value": "ec5afcee095427dd2a75368556b96db3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745655, "uuid": "cf7b8658-8f9b-44ee-ad56-e090f1228bf8", "comment": "Malware payload (AsyncRAT)", "value": "77a3c63dfe1b7c869ed21581f99077e860c26364c166b9f836aa1b10e79dc313", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745655, "uuid": "4a460933-ee21-4168-993b-ceeacad83d4e", "comment": "Malware payload (AsyncRAT)", "value": "0c9936f2441d11e3affea1926381b68d2abd3bc4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745655, "uuid": "503afac4-4f32-45b8-99ef-d8609209c051", "comment": "Malware payload (AsyncRAT)", "value": "9bfd9d00167758127e0cdea11c63aca56e9f95b2d3e49143cf34193848f52ebcea43bf02564c4bec8d7bf1f815111170", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745655, "uuid": "99e814de-4f1f-4fba-8635-9360ddfb62da", "value": "T11E04AE0170D2A435F5BB09764AB58999973DFA205BD0AEDBBF8809BB8F333D06531913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745655, "uuid": "613fa845-bb73-4622-ad71-af939dc7caf8", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745655, "uuid": "2a89e603-19eb-480b-8210-5d153f8f8491", "value": "3072:ufgJH5oz5HTGyqzSnkNqaz5DREKmGUvawfaRHTkw2fIgg9/NNQk:zF5oz5HSmkN3zifaRHTxPn/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745655, "uuid": "fa701072-8e1d-46c6-8897-994a96b66389", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745655, "uuid": "ee5f7b75-5410-40ee-8216-fd26ece1a5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745655, "uuid": "638b58e7-765b-49a2-acc6-cd810ddb6959", "value": "77a3c63dfe1b7c869ed21581f99077e860c26364c166b9f836aa1b10e79dc313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2af3e84-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764782169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782169, "uuid": "0804408a-fe34-4daf-9544-51e604098e29", "comment": "Malware payload (ConnectWise)", "value": "b916bd485541b08339e582fd533ea242", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782169, "uuid": "ddbbbec4-6705-4b5e-bc2d-1684dc933727", "comment": "Malware payload (ConnectWise)", "value": "786ee7f291cc801b11ded6517c66959be7909947d06ad5f349ee14cde1540fc4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782169, "uuid": "f7176d01-1d7e-4cef-9628-30938900e1d4", "comment": "Malware payload (ConnectWise)", "value": "bc9719ba5f554455bbb878899441c38bddf4cae4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782169, "uuid": "aa8fac59-fef5-4cfe-bfd6-516df42bc065", "comment": "Malware payload (ConnectWise)", "value": "6006d18f895ffd98ab10ec70f0744604772f964631e420c357ff93f3a5a6034c7b7c786de630db354320243a4e2cf4ff", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782169, "uuid": "4c759e68-2691-453b-8278-fdc02a72f6fb", "value": "T1C1D6232523FD441AF8F74B79FD3682A45D72BE68CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782169, "uuid": "dc88979d-4929-490a-a4cc-59c17a718ad7", "value": "196608:KWh0cGwBWh0cGZWh0cGeWh0cG7Wh0cGmWh0cG2Wh0cG7:KWaczWacoWacZWacEWaczWacpWacq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764782169, "uuid": "ce92d931-8c29-43fa-9c40-fbbf24773924", "value": 13357056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764782169, "uuid": "43cc358e-4aca-4b9e-a9f0-b51cd918b817", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782169, "uuid": "ec443862-0b14-47d0-8e51-f1f26a3dd1fc", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c79c838-d064-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764778857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778857, "uuid": "2fa78530-4252-4a9d-ad14-671c1ba06de6", "comment": "Malware payload (Mirai)", "value": "9502c5463e08f912f12f9f1d619b2e09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778857, "uuid": "527c4a53-d6b1-44ba-beff-43bb836fb117", "comment": "Malware payload (Mirai)", "value": "788e47fcc1f7e85da5b575ddeb98980fafc9cab532c378855556d679da2a59be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778857, "uuid": "0550c048-8afa-4c86-a375-77c53b63448e", "comment": "Malware payload (Mirai)", "value": "3bc179db0edccf2660dbac93f99d2e7b29876f0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778857, "uuid": "e456c33b-81c0-4703-8649-16fc8f1a1b5f", "comment": "Malware payload (Mirai)", "value": "f75aa92da4b7b5ee3c0770145948a03eeb65beb72db63b91089fb81a4868fa17725f9344667b3aa8a8dd3e06ba0b2317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778857, "uuid": "53f5fb37-12fa-4fff-9877-c2611241dba2", "value": "T120C3E799B8819F62C5D156BEFE1F42DD33231BB8E3DE3207DD146B2436DA91A0A7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778857, "uuid": "332f1e40-f5cf-4f60-9925-c68da29e1d22", "value": "3072:3s09xWqtYHj7X0j9JGMcRLFyU21294H6JBYXir4V/nU1Hn5e4:3sgrt4j7X0JJG9RhyPgwQYyr4O1Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764778857, "uuid": "cc34a7fc-255a-4b88-b7b2-e6000b9754eb", "value": 123604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764778857, "uuid": "71aaec96-5160-4608-adf8-113c7b962022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778857, "uuid": "d89152c7-4805-4a15-a369-20213db8223f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfb8119-d007-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739104, "uuid": "0f801853-f12f-40a7-a7c4-522a327c9ec8", "comment": "Malware payload (Mirai)", "value": "d0623525d64a34aa9a859f0e9564d363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739104, "uuid": "918f64ef-3f57-4e3d-8bbc-2bdf56e3f3f9", "comment": "Malware payload (Mirai)", "value": "78a259d9c6c94a20a7c3ab60de2ff59cd73ebe339fd02ee735ad6c9d5a74b911", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739104, "uuid": "c4b72f30-2053-4f76-a42a-24c3b9e341a7", "comment": "Malware payload (Mirai)", "value": "40a49ead3d760bd5ab6cc4fc5fa42e9651e91154", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739104, "uuid": "c8a17140-bc55-4b35-8446-3a9ddfa2e190", "comment": "Malware payload (Mirai)", "value": "79902927855f11196fbf469f52bc80dbfa0cf9b5cac9ab460334cd4baa66a14e6bf5f8a7354d5cf0183d78a9a7533f89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739104, "uuid": "33ea54f4-3434-483b-9309-1f51ff4bba61", "value": "T14B23F118962E4A474F6124F8CEF9CE1B16C68ABAF1E37994170493F0B82540A3FED51F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739104, "uuid": "d9088fdf-b9bc-48a6-b2bc-b128c7bb270c", "value": "768:vE64CJPH10DYJwqqQ54QGNMwgHeEZnhOXrT7Eb3gsrNMo2C6s3UozSt:vEbCRH17JwMCMwkeEZnhOfxs52ozSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739104, "uuid": "eaf1580b-7020-461d-81a9-6093b117411c", "value": 48616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739104, "uuid": "a69b5fd9-3351-4477-9918-a48fb1815c82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739104, "uuid": "080ab31c-edd7-4fe9-a90e-dd74fbec35fb", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef0da31-d017-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764745978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745978, "uuid": "fdf9e75c-cf21-4d9f-89d9-378ebcf0915a", "comment": "Malware payload", "value": "d7fab82913d0ac3d0070a5569a53a7a2", "object_relation": "md5", "Tag": [ { "name": "sostexampp-duckdns-org", "colour": "#B90507", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745978, "uuid": "f8b2af74-cdfe-4395-b845-f5c5fe1b90fa", "comment": "Malware payload", "value": "7aab9283bc3a6e6bdf97fa60443aa9f9a7555ab11f1d284e37506bc0f7fb63fb", "object_relation": "sha256", "Tag": [ { "name": "sostexampp-duckdns-org", "colour": "#B90507", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745978, "uuid": "8cfa163f-562a-4f17-bca6-56b6d1a4e524", "comment": "Malware payload", "value": "c966923b2281b6721efc80a8a238f8243755852f", "object_relation": "sha1", "Tag": [ { "name": "sostexampp-duckdns-org", "colour": "#B90507", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745978, "uuid": "8de0861b-5650-4f69-99ef-ec425bf4c884", "comment": "Malware payload", "value": "be49e5a19518f8b3f3ecade9d310a700013f5ebefdb514a37d8052a054b9efd37b2efe371ac6e0220f7874315c34b16f", "object_relation": "sha3-384", "Tag": [ { "name": "sostexampp-duckdns-org", "colour": "#B90507", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745978, "uuid": "a3a1c01d-2f75-4b07-ab39-03dd04bec37c", "value": "T16056819282FD8218B6B35F8EBD3A96029E37BD431E3ED12C6D5940A85D31B51DC707A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745978, "uuid": "7693f486-518d-435b-b7db-281f2c07e3ac", "value": "1536:oVEgFjE5VwTexnQmmmmmmmmmmmmmlAUO0W:oVEgFjE5VwTexnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745978, "uuid": "ff9661c3-2bf5-4a4d-9926-97d07fefab32", "value": 5978680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745978, "uuid": "900a24e4-dd7e-47b0-8c40-b71395034662", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745978, "uuid": "e22acd4f-e35c-4895-ba88-a0ac7178e0be", "value": "7aab9283bc3a6e6bdf97fa60443aa9f9a7555ab11f1d284e37506bc0f7fb63fb.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1138ac-d043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764764740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764740, "uuid": "751da721-cb55-40b8-9f20-6bc37f9ef725", "comment": "Malware payload (Mirai)", "value": "f65e2d4abb6222c6d35047130dd23238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764740, "uuid": "c526b279-1970-41f1-a16c-5e656086a18c", "comment": "Malware payload (Mirai)", "value": "7ab64102d7c4b53750add9a5505a4b67d5144642dd78b8b2ec90029d6920e1b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764740, "uuid": "bb406e5f-701e-4c01-8cab-59c2e896de37", "comment": "Malware payload (Mirai)", "value": "859e132265abba999f44b66c042c3afc9f1cd0f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764740, "uuid": "56c11289-114e-49ee-832c-eb3536359dc0", "comment": "Malware payload (Mirai)", "value": "255cf4511dde54e9fbf14bdd60b350d7f8f086a12726b158acb47095f78a635c848ba531d150855134d01144f91f2b8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764740, "uuid": "95b15093-d2d7-4495-8c3c-8537dd8cbf22", "value": "T15DE3B60E7E219F7DF7AD863507B78E24635833D622E1D284E16CE9111EA038E642FF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764740, "uuid": "09f8e242-c69c-436d-b47c-9a725c53fac4", "value": "3072:rVVUXBxNVUPEtdM8yeuL9OCHntjzYeWvMHl5OlCbAgeYuA:roBxNVW5LpntjzYCHfOEwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764740, "uuid": "3b274c9c-cb51-4221-9298-4114006473fc", "value": 156624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764740, "uuid": "40b43f88-3e1e-414f-acf2-9bced81137c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764740, "uuid": "e8b7b3ad-bed8-4832-8666-79db43126d9b", "value": "Yboats.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded4af2-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746862, "uuid": "5d7912cd-8d27-4d8b-898f-ad07cd47f0bb", "comment": "Malware payload (Mirai)", "value": "04ce8dfb9eda121800fe9533e821c178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746862, "uuid": "4584d2f7-2309-4397-8f5f-a43b5746f30f", "comment": "Malware payload (Mirai)", "value": "7bb0dbdfd9377feab4bbdb2441aa609d0c61d38e4d89f4cb2c3c98d5b6daf7be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746862, "uuid": "9fd93d94-a7c1-432f-8b46-310ba62b1f63", "comment": "Malware payload (Mirai)", "value": "242eda4f808a655e7089236d43d499d8e4ba7472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746862, "uuid": "4b2149a6-3db2-4f5b-929f-7a251285dd52", "comment": "Malware payload (Mirai)", "value": "fd9596baa84daf2982e1f03f9b976d0c0c5527c2d893a4131488ea12f3ef6904cc3a7cdfaf302012a89ade5619c5ceaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746862, "uuid": "37db7771-776c-4cb1-a13d-2c00982eb26e", "value": "T11CD32A86B8D18F11C6C526BBFA1E018E332657BCE2EFB1039D245F2427CA56B0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746862, "uuid": "4691864b-7218-4a0d-818f-6aa734fa86b4", "value": "3072:RTx3J1yWq7nVbWjkVeiejPjtpESezad4N5a7h+DOF/:RTtJ1yWqTVePLHYzaeN5iV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746862, "uuid": "aa5a62ce-6625-43f7-b00b-40b1ed953987", "value": 136792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746862, "uuid": "b9a2ccd3-b52b-45e2-b4b0-e469c791a551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746862, "uuid": "766b4b13-73b4-40c5-8451-2a3bee7c29cd", "value": "Yboats.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84c84b3-d044-11f0-a129-42010a9c0007", "comment": "Malware payload (NodeLoader)", "timestamp": 1764765401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765401, "uuid": "e67dd0a7-69fe-404a-9ee3-cf157c2fb5bc", "comment": "Malware payload (NodeLoader)", "value": "036d6762367c275828d6c3bfee1a6920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765401, "uuid": "fab85ce7-9e1a-4e7b-a55a-06621dd581e1", "comment": "Malware payload (NodeLoader)", "value": "7bcacbbad0d5acf32d06a8915edfd1e65e3e6bb8b442294cb55ab4c34cae7a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765401, "uuid": "328dd805-763c-45f6-bbef-f9badd504752", "comment": "Malware payload (NodeLoader)", "value": "fbd58195fc909445ac952084a483dc87f44153d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765401, "uuid": "24026ab1-2600-4874-8dff-60e1316dd6e6", "comment": "Malware payload (NodeLoader)", "value": "85999684bfad06e45aad1f9f544dabe3a34e1df71728618a8ec9eec336afa3358de9cf1291d97ed8db8ca21a89e96efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765401, "uuid": "c44378ca-da5c-40ec-9390-efc42e4cd48e", "value": "T1FC087B42A7EA04D5F9FB9A3489F65213D673BC062F3085DB324C172A1F736E09976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765401, "uuid": "caa13505-b4be-4432-a7d4-36e8da504a8b", "value": "325b594b25b7c06988a176a364565897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765401, "uuid": "aad0b9ef-402c-4817-9611-46688f913281", "value": "393216:Zp7brJts4rbrvSvQNhOiImMUY6555SGEBqXjJKTpEdN5gsbtFKx2Xinsp0AchER4:ZNLsCBuUoA/qYX/9PlBxOWhbeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764765401, "uuid": "63027d35-bfed-4e24-9a17-cdc2583249a4", "value": 80989307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764765401, "uuid": "9937c1ff-5d27-4d8f-819d-5dab9a02aaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765401, "uuid": "fe9b0cf2-eafd-4aaf-ba9e-1e81c54f897c", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7e22d4-d02e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764755798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755798, "uuid": "09263d65-c95c-4b1b-8d2c-078a1de63af3", "comment": "Malware payload", "value": "a395b25c02448416692af2a14633d40b", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755798, "uuid": "46c7b0a7-04ae-4ddd-a989-71e660f1dd9a", "comment": "Malware payload", "value": "7cb0cedc3e39b2efa9fc91d144f1932a5c2abe06156641dbdab0eec978955c45", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755798, "uuid": "6742bc0e-7daa-4724-935f-7a0fabf72800", "comment": "Malware payload", "value": "36d2f8241d58a41aabb69070a56a142e42940cec", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755798, "uuid": "078990b7-f191-4621-ac06-6fd0a35bb160", "comment": "Malware payload", "value": "37b5e21aa2809384d251730ef9591ebe8fb4d96c33408dd31759ad7b282f133b49d3ff1f5f0db587286f9d72e820cf59", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755798, "uuid": "ded54ffc-f4c6-4fe1-8de5-60d1e24a5bc8", "value": "T150D05B7C8342C14DD6725D3EBDE0FE04241DFE918CC3A6CC14C5EC4705910D575406C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755798, "uuid": "5a6a065c-35e9-438a-aef4-f73e0cf54d74", "value": "6:HRYFVmyhApkS2m0iA/1+KVA7YmBBArSDxDfWa2zyNzGE54vVG/4xHy:HRYFVmyAEZ1n4BBArSlunzPfVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764755798, "uuid": "0a62ab62-2e8d-4e4c-b297-84850cc7e85f", "value": 286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764755798, "uuid": "5aeda94c-fe85-4f59-9156-74a0f3051573", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755798, "uuid": "8f873649-0bab-4c98-8516-fa8f6ee4296a", "value": "INV26638463444.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8c8951-d046-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764766084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766084, "uuid": "890303d7-4bd4-4caa-8e72-bef90306c730", "comment": "Malware payload (Mirai)", "value": "d4e1f82ec0f871ab2ccf7ac17260f6d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766084, "uuid": "428047cf-8990-4deb-b9ce-d24460b61874", "comment": "Malware payload (Mirai)", "value": "7cf1b7da477075d7c365bd1fb986b170fac4e9c5b32252ad7e53940e24495f86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766084, "uuid": "a07517c4-08d9-4e5f-b011-b3df308f05a1", "comment": "Malware payload (Mirai)", "value": "0b2d95a76c7cadfe7929d413c154d865d3410848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766084, "uuid": "e3fe40d3-e893-491d-82be-948bedaa0235", "comment": "Malware payload (Mirai)", "value": "6d7e9127ad8abc1833e6a2a9cce77e3f3dceb3b4bfaef9cf800f1ed254bfe14a4a4a5192d20f2517159380b1f21bef30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766084, "uuid": "c53de9ea-52f2-46ed-8ea9-673f6a747f99", "value": "T17BC37BA86A0F3DD2E2C7D37DCE484E62712B75F0C62182B17D02536EC6DBCAA99F0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766084, "uuid": "1665cf8a-a367-443a-8eba-05cb974e4a83", "value": "1536:pUczhBGapAtMvcA09hPhoOFJ20Lakk6C6OedML34jkREf1idzYX3xctelTGuylcS:ictEA09m4jkREticYeNnyWe/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764766084, "uuid": "1ff2dbff-e572-4ac1-8506-aa56a0055089", "value": 120616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764766084, "uuid": "ae1bba63-81f3-48a7-9831-1826ab922e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766084, "uuid": "1a4e78ec-33b5-49b7-baf4-cda530de1f85", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aa219d-cfdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764721778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721778, "uuid": "e491ca95-096d-48bd-ada4-db28a59c7194", "comment": "Malware payload (Mirai)", "value": "33dc1639888005a00f1b2b8c73432b92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721778, "uuid": "e5e44974-939e-4ba2-bb21-12ccf1f6b169", "comment": "Malware payload (Mirai)", "value": "7d98b3cc8507fa58772f6e9c491e164d2ab39cecde19124c6e893aa8ab203ed6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721778, "uuid": "a4577d16-9999-4726-a926-8131c14d7a84", "comment": "Malware payload (Mirai)", "value": "7746c6bb5ad482b5e9c307865111719a79f6eedb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721778, "uuid": "a712729f-90f7-403b-8e5c-61f589a2a362", "comment": "Malware payload (Mirai)", "value": "b7c677b3cd4f13503c77a54820d7a8cf37face3966f2fb98eeb2de694b7658571093b6fc0a3c14b35df8ddaf8d0ab4f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721778, "uuid": "08a865ee-2e77-4782-bf71-3e0c0e1ffa2b", "value": "T15ED39D73C8BA6FA8C564D5B4B0318F782BA3A55181471FBE59A7C2B54087D8CF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721778, "uuid": "6a1d5f45-7174-4619-8e0b-9cf9b6a8528e", "value": "3072:Qc6f9t2CwVvHt4xeyZBC+5fbBWE1svhMK5:Q1f/Ut4xeyb/bMECvhMK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764721778, "uuid": "b0ae779b-2b36-41a6-b0d2-068b2b634bdd", "value": 134752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764721778, "uuid": "da944b11-0e2e-4608-9bf8-296fc835e3dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721778, "uuid": "a2eca1bc-26bb-47cd-b546-f52556665309", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559a0a23-d087-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764794012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794012, "uuid": "d0d4236a-77f6-4125-a8d0-cdfbe81bc709", "comment": "Malware payload (Mirai)", "value": "92021dc41235a9bd52a99438fcc01d31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794012, "uuid": "1b412a8f-d53c-415e-87b3-8c1fc8232768", "comment": "Malware payload (Mirai)", "value": "7df933647484b9ccbd5f3be577d5e6f996c3adbfeccea2723065edaa646bf4aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794012, "uuid": "8f1b4ce4-0ee9-4a4e-8595-4c57ed870fca", "comment": "Malware payload (Mirai)", "value": "61fefe535ecc1a2af2a7b31f4ccb7b32df49c0ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764794012, "uuid": "3772a5c0-6153-4708-806d-99dcf942a348", "comment": "Malware payload (Mirai)", "value": "bc3342a826bdaeaeb19ca5649f4a69182f31751bd1be62b3d4a1104d2eb430dced654232c12c675103febf76de6ba2bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794012, "uuid": "1eae4d3a-0713-49d7-a6e9-2639c43442b6", "value": "T12A737CC6F643D0F4FC570470207BE7375A32E1FA1129EA43D7A89A72EC56602E616B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794012, "uuid": "ecc5b7fa-3bec-41a0-bc6b-a1b44cdd7a9c", "value": "1536:wp6kfm+q4sX4YFAO+PxV9T8x/ReOSpwLtH5oyhg35f9kfzM4NSNTQ1SPk:wAkfm+q4S4YFl+5V18ppyye3h9uIv7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764794012, "uuid": "3672d5bc-edd3-4120-aa47-6c35f25e419b", "value": 79280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764794012, "uuid": "578a2bbd-70a2-4dcb-98e1-61f0cb79225e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764794012, "uuid": "51a8cbaa-4bf6-469c-9f10-8c9fd6715d81", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e36ca6c-cfdf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764721951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721951, "uuid": "ed64b8ad-e453-4299-8c92-8da5d914ee8f", "comment": "Malware payload", "value": "aefc416574c7b5df8221741d7c20f41a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721951, "uuid": "fac01b86-f57f-41f7-ac98-5f1a0a8d4c77", "comment": "Malware payload", "value": "7f0b01ee40014edf8c97610ebabdc91130a36ab7e96782c8d95c25b48a920a8e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721951, "uuid": "2616ee18-3881-424e-bd4b-20a13b89b5a7", "comment": "Malware payload", "value": "2474ba04d967c9dfa9a047992dd27fe5100a2b86", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721951, "uuid": "6200bf22-4ee4-4aa8-9c2a-e7e80360308d", "comment": "Malware payload", "value": "c73c2238e2793b88da1846eda42fb88c5d05e913792ade04dbd34a4464cb9081dd6eea4633b7771c8d101f400df24978", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721951, "uuid": "26554f81-e0a8-42a0-88b7-53387bfef943", "value": "T10E73418C89DF84EC961775988DDF9C16F7E8C423562CC6D1BEADA9E42F0183892F45E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721951, "uuid": "ad76a6af-3a2d-42d4-a3ee-2450d16e687e", "value": "768:2/lL4ozmwiAq2bpveuUj2Ajyyptouh3Zetr84wDwzzfwrHZUZprkKh+Ht4PMdo4B:iRIz/tou/emZGGZUZOaXgdBjAMM/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764721951, "uuid": "58c5acbc-aa39-491c-b8b1-5d54073c6fb1", "value": 76903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764721951, "uuid": "497d6e53-c6df-4ffc-a3e4-2702775bd24b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721951, "uuid": "34aede54-ce04-4f3d-b6cd-d519137fe13f", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425e065d-d004-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737716, "uuid": "3c61adb7-1e51-44f1-95e3-846ca3a3cbf9", "comment": "Malware payload (Mirai)", "value": "973e20ffa567d6be518213a690a7f04d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737716, "uuid": "e58469d0-b66a-4466-bb78-b9ece4553daf", "comment": "Malware payload (Mirai)", "value": "7fdcf9339180f7eaf8f2c862c05541219e7fed45ba2349cdf0644ef40d286c05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737716, "uuid": "ff0f52c4-1242-424d-830e-26c339af4369", "comment": "Malware payload (Mirai)", "value": "8b2ed16923761fad287c795eac230713c54609fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737716, "uuid": "01ed9a01-8445-4471-a9c7-37fc2553c122", "comment": "Malware payload (Mirai)", "value": "bc616e7d63f36286bb43680505c174a5b767c21c5863e1a6a6c22597fc1721855f8b2d4e1443a64aa0ca8f22fe17f143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737716, "uuid": "0704f5c4-d519-42f8-b01d-f2e9b726c30b", "value": "T197C3127D0677D453E6869CB8D0522DBB191081BF2BEA6C069F9DF79CF07D10A46C218B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737716, "uuid": "d495c84a-a548-436c-8643-a76eebbd9610", "value": "3072:mrEqYlHozYoCFOMxRWGScGuikbfAGDfarS/:kEpozYnSGScLTboGza8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737716, "uuid": "e5a03c21-3a7e-4d3b-9072-30b4adf85591", "value": 126740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737716, "uuid": "03002fb8-fb6a-4d96-8c51-acd272ad97e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737716, "uuid": "754b6a80-7b20-4f9c-9c7a-61e0174da2ba", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c249ef68-d089-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764795053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795053, "uuid": "8b9aa841-dbf5-4596-818b-049dbccc88ef", "comment": "Malware payload (Mirai)", "value": "d1a80bccdbb6548111a69e4449421e8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795053, "uuid": "9b14725c-fa3f-456b-aa0b-511fec6bf2d0", "comment": "Malware payload (Mirai)", "value": "805c4da37a81203e8e36cc7a2169cf2e9f261154b510288ba4170e4853f17b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795053, "uuid": "2f236b3a-3141-44e1-ab14-4ae1bae4e3ee", "comment": "Malware payload (Mirai)", "value": "13e70b989299b837b8351e39ede0e84e3d839166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795053, "uuid": "bbabc12e-ea14-45e0-abf8-f9d7f69e0ed9", "comment": "Malware payload (Mirai)", "value": "d6622b182de6d2b43d587bb6bd145e70dca25c647681d3f227bc22a363d7382e2531e7fa33b31c28f0c97d3c359d39d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795053, "uuid": "fba8de9e-6b52-4439-9f33-3ece6b0067d1", "value": "T16323F128F5036D52C4669937E17E61CE7A0131BAA6CB3C401D650D2DB6E729307BE4AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795053, "uuid": "566c7e3b-c708-4af7-8aa5-19ae2c3de4d8", "value": "768:OkXsan8kAZvGKG5jiRNo/BkmehwwrGrWvO38ldkRrSxW2Nz9pJnVp9q3UELfi:OkX78kAZuKujRkme5rhvflIsjNzBiLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764795053, "uuid": "51b33c5c-0c50-436e-89ad-7af2f2bb6bb8", "value": 46112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764795053, "uuid": "fee140b7-caf9-447c-891f-6295780e06ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795053, "uuid": "1d2877a0-e380-4288-9b36-7d1ba2a6066b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b4478e-d087-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793992, "uuid": "6fb2ac4f-e498-485e-a9d0-8063a47fe159", "comment": "Malware payload (Mirai)", "value": "c1e47a19506e043d54959f2e59896935", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793992, "uuid": "1ffe66f5-dc38-40ad-9c8a-f90223b2eb58", "comment": "Malware payload (Mirai)", "value": "80d4fa148408c15cab91f173d94d4ab2322ef02c5b9b5dce2778837e182f7f82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793992, "uuid": "3639e0c1-27cc-4e68-b898-e3ae31c73a20", "comment": "Malware payload (Mirai)", "value": "f08cf4ef6488a4e67d31f6b74e5426ea43f63270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793992, "uuid": "d54c023a-9e61-4c45-b2cc-81a106fd10a1", "comment": "Malware payload (Mirai)", "value": "43318b8da027d403afcded969e61ad11f6ae1ca59749b44c2b9343adbd3d634a4e139de1ad685feac98a5836647d9e4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793992, "uuid": "ba8f29fb-a9f1-4e4e-9ead-0d5b9dd2ef44", "value": "T195B2E0338B30AB31C931083BBC3AD611DF965F3195BA745A69694B242FC1ACF52BC589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793992, "uuid": "4efc68cd-0553-4887-90de-fa6ef9056b15", "value": "768:4bOIC33oVXf7LfjsB1oKKwDP4ocs3Uoz1:4beop7LbsBjKCPbz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793992, "uuid": "f58d01e8-0e1f-4751-8237-dee6ff484471", "value": 25644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793992, "uuid": "f280c9c6-c44c-433c-860b-c1942f8297b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793992, "uuid": "6af83eae-66b6-4ed3-9548-655118a2400c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e908751-d049-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764767505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767505, "uuid": "5156c746-fa84-442b-9858-28d9c340c267", "comment": "Malware payload", "value": "c7410c9f8db1eaeec7e764c8b67ee67f", "object_relation": "md5", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767505, "uuid": "150b0410-ca9e-4aac-a39c-9e15d7f731fa", "comment": "Malware payload", "value": "80fbcdee94c29f79fc80f0ae88e83367ded4c833cc8ff8d345064096b0b96495", "object_relation": "sha256", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767505, "uuid": "9574bf13-dd32-4aa6-913d-af74722fa310", "comment": "Malware payload", "value": "d7ec968b92c81d6b1af6282b629f2ecd0644f433", "object_relation": "sha1", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767505, "uuid": "190eea8a-4dfa-4740-8f53-dd0160505243", "comment": "Malware payload", "value": "fcb4eec308520580b0b5c70852e71ec480fba81bf6fcae18e90026d8a960c6413f96cf5854a217102ac66b8308161da1", "object_relation": "sha3-384", "Tag": [ { "name": "206-82-9-241", "colour": "#AFC0C8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767505, "uuid": "7a7a05d3-9be6-4959-8611-39378357c245", "value": "T110F4F111B6E64D3AE9E31B36FFBA92505A79FD638A30C21E16D4311D0DB1B92D1A0337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767505, "uuid": "7ea4b68e-ffb5-41f9-981b-0be10169005c", "value": "12288:hNUT5ur37w4KmiCvk4Zgg/iPM1eF3mPfHdU+a/hk2jrLoYbIuhn5FN:hNUVI37MmvkKgvPwcmnHdU+GG27hhx5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767505, "uuid": "d4fe97d3-056e-4773-8637-1224267772f8", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767505, "uuid": "f563258a-0843-46dc-8f9c-41d50e61e36a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767505, "uuid": "9cf1ea93-9120-4baa-858e-7dfe00afeeda", "value": "80fbcdee94c29f79fc80f0ae88e83367ded4c833cc8ff8d345064096b0b96495.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888d2811-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764767469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767469, "uuid": "1a169204-6338-4a61-8e9c-aba08f5722f2", "comment": "Malware payload (Vidar)", "value": "e752afc2f32dde016987be6afd6ce7e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767469, "uuid": "c44650ba-9e96-47ff-a782-704c0c8e8f47", "comment": "Malware payload (Vidar)", "value": "8161cb945649ce826b50d73d34adfb75e02a380da17babd90e1c240b364c08fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767469, "uuid": "1e94a4c2-b957-4262-a52e-1ccff51bd65f", "comment": "Malware payload (Vidar)", "value": "4c8f44a2daa76e6df3a2b5cc7cfc38809b6fa9f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767469, "uuid": "713d3b60-c7dd-4dd1-8136-987900a4552d", "comment": "Malware payload (Vidar)", "value": "108d2b3865ffc90a546a7f37a45428747a8d1904a7ab4e088306d0e030ee62f712a7e6d83bfb8f6f7bd753ef1c912c3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767469, "uuid": "000adaf0-2929-43ff-ad51-385b751cdb23", "value": "T17E365B07A8528469C09EF135AAF760867AF87C080B7137C32EA37E74DEB27D494B6715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767469, "uuid": "1b411bd4-e371-433e-ade5-3306086c49e0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767469, "uuid": "ef86a607-7c9f-4fe4-8d02-d47309969e7a", "value": "49152:vu49q6gpxahkbQO7o/0yMYpuXW0DEuJKBZZf0ZO/zjhkUNEpCdo0:vjihDirnrd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767469, "uuid": "2affe84f-909a-420a-9340-a0421aeaf93d", "value": 5148888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767469, "uuid": "75067cb7-8fd1-4a2e-b042-420353e0c183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767469, "uuid": "e85a551f-f586-4d05-a416-9fb5f0406462", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b612eb-d018-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746472, "uuid": "22837cfa-ce2e-415f-8d90-9dcfe239f713", "comment": "Malware payload (RemcosRAT)", "value": "fb5433a8523073d3c155b987d13c48e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vuloinsioscollid-duckdns-org", "colour": "#D0B2B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746472, "uuid": "30cddac8-2936-4146-9cf1-138227c03edf", "comment": "Malware payload (RemcosRAT)", "value": "820e9bde246981cf653616887b1b6a5fba61bacb3e1d8b30ca9f2c7af54a573d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vuloinsioscollid-duckdns-org", "colour": "#D0B2B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746472, "uuid": "1dab08d7-4b70-4bb8-b251-7b7e28c7f649", "comment": "Malware payload (RemcosRAT)", "value": "ac8afd71f5911fd3f62f386e247ecdcda3525afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vuloinsioscollid-duckdns-org", "colour": "#D0B2B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746472, "uuid": "00d0b647-4af3-400e-9042-873dce226000", "comment": "Malware payload (RemcosRAT)", "value": "89648176b034e12fccb3e2574bec999e2a2048588242e95da0d9bfce84aea35b1f0f300ba0c6339d4876dfa98af3919e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vuloinsioscollid-duckdns-org", "colour": "#D0B2B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746472, "uuid": "bb0475ad-1a59-4e9d-987c-1597c8d3f35b", "value": "T170B4AF11F6C2C1B2E67614300529E7F5DEBDBD201835997BA3EA1D57FE30180DA39BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746472, "uuid": "082007da-c3e3-4722-ad96-c1c0f18f3b68", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746472, "uuid": "08079b8a-2180-4dfe-a378-c3b0b963f911", "value": "12288:WBqw1FSGa8qvS7yserVAqaReR9NsPZ9BmPFN:W4w1FSj8qRVAqaRlZSPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746472, "uuid": "ee724b74-9629-4239-ad7c-0594a8d8f5ad", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746472, "uuid": "c0834a6e-e472-4760-b611-3d085697f059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746472, "uuid": "a7dcf06f-e60c-472b-91d1-e585b8cd3cd8", "value": "820e9bde246981cf653616887b1b6a5fba61bacb3e1d8b30ca9f2c7af54a573d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea5ba38-d084-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764792739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792739, "uuid": "f6ecabea-9825-42c6-9e9e-ac9aa7f11772", "comment": "Malware payload (Mirai)", "value": "303e2ca3778adba2502ddc7d65b35c84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792739, "uuid": "8d307b53-55d9-46c6-98d8-8cd2ac7cea4b", "comment": "Malware payload (Mirai)", "value": "8381505af7af56d74cf3b56f52e8f7799f445744d563fbd0f03449df589ec695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792739, "uuid": "9802090e-0b22-4426-860a-01a88d3c33b9", "comment": "Malware payload (Mirai)", "value": "38d452ab107795d9a65d7367eb575050f98630e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764792739, "uuid": "5ac61af3-a461-4311-8e0c-fb93ad842925", "comment": "Malware payload (Mirai)", "value": "6ab0ed208a3e104ebf4d8af9ea5dd0e061f046858a2320c0ef2f9dcadeb171ff27dd98d6bac4a67db0848419d3cbe2b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792739, "uuid": "24efb114-bb2f-4327-a4ff-c95dae98969c", "value": "T104934B02B3180A47D1A34DB03A3F1BD1C3BFA5D121E4F689692E9B8596B5D336486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792739, "uuid": "b9d33e89-bc12-4bd0-8de0-2e77a0fa658f", "value": "1536:wrTRtMgxWLtLcDcTD+rdiYRQpPixbbUZrvoxnH7OGdpKTq8kJ+unHxpeECO7HnjE:awoWLt9T1Y2i6wpg2+2xgM/mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764792739, "uuid": "e92387dc-5c6d-44d9-96a0-7a824fc819e7", "value": 92064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764792739, "uuid": "eb099072-d55d-4f97-965a-affcd3695d44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764792739, "uuid": "8faf6b8a-280d-4fa7-bf59-c8de27c7aae0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6f4315-d064-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764779068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779068, "uuid": "60fa025e-d204-4a5a-95dc-ebe1b54be88c", "comment": "Malware payload (Stealc)", "value": "f0a638cbbb4b527f74e59f28e372cc40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779068, "uuid": "8c0c6cd4-4a94-4357-9a91-e68b42bf2b6a", "comment": "Malware payload (Stealc)", "value": "83863006b4dda98ef3dfdf417d11b099fec994d1886ce7e91c4e708e23bb2ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779068, "uuid": "69b92267-03dd-4d28-91fb-aa02d054bb3b", "comment": "Malware payload (Stealc)", "value": "7c8b34ad475fe123b939183e56d7803e6f533d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779068, "uuid": "42c447c5-f674-4e60-a94a-704f4d83b345", "comment": "Malware payload (Stealc)", "value": "fe7d2b911cde97be5779fec81329a105dc08480ba7e8bfeafd1fe1bdfb6ce09cbadab70b20e6ad5a3cfb51222442edd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779068, "uuid": "09b0b731-fbf3-41ca-ad14-6a177a6276ba", "value": "T17728D742F9919894CABAF134A1927270BAB53E5943317BD35FF81A660C367C02B3EF54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779068, "uuid": "8c7ad499-c26d-40c2-87ec-eaf528eb03f1", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779068, "uuid": "728e35c4-f225-4bf2-a962-c7ea7c573776", "value": "49152:xmlKa/qEa3WEMnl7IOYBz+SPL0f7uYpCHMeGO16IdK1wOm:dEa31Mm+wOZir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764779068, "uuid": "2752911d-7d84-403b-af8b-01bdf6e4a7bb", "value": 96552072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764779068, "uuid": "f23ac108-56ab-4b1d-96e3-12c75a413201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779068, "uuid": "87c26ef9-6075-43e5-85d1-8d80222ce232", "value": "XTS.loder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d81fd46-d054-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764772040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772040, "uuid": "6deff292-1e50-4f18-b82f-d6829210794f", "comment": "Malware payload (MassLogger)", "value": "f2a33a331598720bcfbb982dfbbe1183", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772040, "uuid": "9a5d6459-e76d-4615-9859-7700ae745576", "comment": "Malware payload (MassLogger)", "value": "84198fc8f345a58baa065f9e03e2fd47b512bc73d4370d2dacc4fbf91e435e14", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772040, "uuid": "2b8fae58-ad5b-4f49-87c1-1abdfc4ddf5e", "comment": "Malware payload (MassLogger)", "value": "de3ab25531683434b94c30d35c9446efc444bbcf", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772040, "uuid": "c39775ac-46ee-46d9-bda8-ca1e41415a26", "comment": "Malware payload (MassLogger)", "value": "8360fb9c37751fa8fb087ffd420df490c60f72a10cb549aa9f30f2ad1a97f3b305fab80ac284fa802785b155ff73c42b", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772040, "uuid": "1cc57fb8-1548-4c43-b30d-5851f5c09e6e", "value": "T1D155E15E4061ADC2A000FDF0F541AFA7CCDB5794122356221FE568AD6322D83FFAB6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772040, "uuid": "ed979234-62f3-4a65-b5a2-86a3a2b02adf", "value": "24576:RQYvsaa6y9uJI6fgVB1jCEiSMis2ztjaiRU2hxJ3bmdC6:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772040, "uuid": "13d5d4a4-79c5-4742-97b1-e78dd42decc7", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772040, "uuid": "cee28f42-991b-4bf1-9eae-e9b974c8d9b2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772040, "uuid": "1f5410be-7a4d-4471-969b-ee0a0dd1207f", "value": "e-dekont.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6885c2e-d005-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764738313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738313, "uuid": "7b4001b8-0e6b-4394-bb19-a4e632000618", "comment": "Malware payload (Mirai)", "value": "19b47e736d299d4591763f23ea8a0cc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738313, "uuid": "650c9022-8e7f-418d-bf45-c01f369d25c6", "comment": "Malware payload (Mirai)", "value": "8507d75a29b59ef01e4c21a577fdc8832292720e5f25d2eef0105d1f02cb2a75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738313, "uuid": "3baf1e4d-b324-4cbe-8604-050b60ea1f70", "comment": "Malware payload (Mirai)", "value": "b3155fc237b2edeabe56876a752c4c896f752ded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738313, "uuid": "89583909-a05d-4cbb-9e8a-874c8537221b", "comment": "Malware payload (Mirai)", "value": "beeb50ef2962cf9b1885717b0c8fa700ca07deb7f9b167b2528d3646e27ac2ca11e589ea0b377670aa61611ed7e7ffad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738313, "uuid": "8349ece5-d8b6-44be-9dce-e0e99fcb7fdb", "value": "T1A534AEA7FB4E0AA1C84601F40BCF9B6D6E1301464DABC3E6B86935391D7B4CF1526BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738313, "uuid": "259633a0-37fc-4ae5-a7d1-03c21d066ddf", "value": "3072:5jD0uMhq2UNtKeHUSMyvznzuNRUtmsfVDWIZ5gSCMVX64Yub01pIJ2t6q:pD2hPcb1vGNRUEqpWICMVXet6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764738313, "uuid": "3446f852-fc2f-4235-9275-9cef94a9a458", "value": 247608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764738313, "uuid": "a3e9597d-830f-4a05-b624-5406d17cfe20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738313, "uuid": "9241983e-8b36-4447-bb90-66d51fb09095", "value": "ecco.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bb6116-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767382, "uuid": "3b525238-798e-4bf3-9f40-852d8f4d55df", "comment": "Malware payload (Mirai)", "value": "5a12a0d0eb69138be850b5f3c5236d4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767382, "uuid": "7588c377-3d3c-48b9-81cb-34441e72fd7d", "comment": "Malware payload (Mirai)", "value": "855db368a73fc4e44b2876f6ecb33d1c5135a93f50ec717d99ea495c6e692c58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767382, "uuid": "4015fe9c-fb5c-4f9e-9fc7-ffe6d82afefc", "comment": "Malware payload (Mirai)", "value": "c6e348c55025bb4d9f03df115c8185a8123703f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767382, "uuid": "36e07ee3-7d9d-40b9-be9f-74822a7fccca", "comment": "Malware payload (Mirai)", "value": "632ac07d9ed893b1ca7575d657b7332bc42e7ea1efab53ce2fc892b09c3f279cf58037cb55d623869cd4029e5e43ba54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767382, "uuid": "48d534c5-f3aa-4a63-bea1-d6eddbf4c6de", "value": "T1C5633A81BD815A63C6D112BBFB6E01CE372613A8D3EE72079D266F21378781B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767382, "uuid": "b41c2b53-a53e-4569-939d-08b9c6fd2439", "value": "1536:g1NnhydU0LklPVBNMt+Zo82Op3GlO9NUVyZvXo:g1N0YCt+yHc74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767382, "uuid": "2aab2ef5-3c9a-4040-a761-0d39c74f32d5", "value": 73348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767382, "uuid": "62a8d18a-3a60-4216-8876-3737ce3c6191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767382, "uuid": "a94031f7-e9c2-4fc8-a72b-d66ead37c2d8", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a39003-d003-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737298, "uuid": "82d727a6-9bce-47ab-8096-268b1977fdfd", "comment": "Malware payload (Mirai)", "value": "39181fcf07eb644abcc029c0fabd46b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737298, "uuid": "07729391-ec15-4021-aa73-b012507e9fd0", "comment": "Malware payload (Mirai)", "value": "856140506ac3f3ed128dc4bdf81862e10f52d42dcd6ac8924f661e7cd7bfa63c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737298, "uuid": "22f4c013-41a1-4449-9830-f20b9ae21beb", "comment": "Malware payload (Mirai)", "value": "0a59287c92faf31c2091adcd46d57ec357c678ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737298, "uuid": "601e2269-8933-4145-83ed-9849dbdee93c", "comment": "Malware payload (Mirai)", "value": "0aaaa1754699b4d3ef0fa4897de16b8691da077e1208a45c7d4ec4c82f1d831ac6acde639e78ad95820414af74869c7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737298, "uuid": "0d25c41e-bfaf-4661-aefa-d8751b4f8bc2", "value": "T1A5833B92FC819A5BC6C512B6FB2F028D371613A9E2DE3203DD259F11338AA2F0D7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737298, "uuid": "59fdd281-f77e-4be9-a124-c4d408ee90a9", "value": "1536:1ZDqagQVwPMU/XHaL+edmqd9Pi4LkY9aqVbHRev0vpd:1NngQ+PMT+ekiV5LkYA0xPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737298, "uuid": "9ba18775-3276-4d71-b2d9-a8300095a5ea", "value": 87700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737298, "uuid": "db610ecb-826c-4859-b03e-548cdaf6fec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737298, "uuid": "76330d27-406b-40bc-9ce9-e483e3da8f6a", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9060ad-d016-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764745648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745648, "uuid": "01f94ee0-d671-4762-bfe2-9e7d63e1f190", "comment": "Malware payload (AsyncRAT)", "value": "806a20a82fa770db1642e53942ebade3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745648, "uuid": "a9a2b1ca-0e5a-4413-a250-3c598ec5512f", "comment": "Malware payload (AsyncRAT)", "value": "85a1f1233894080f2ad174004d240fec588ec2c941824f71ca10b4e65602b50b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745648, "uuid": "c158a1e9-10b0-4b9c-a6aa-661f63758b57", "comment": "Malware payload (AsyncRAT)", "value": "bb51652970895dc5381b54b68b0fbfb374a3e82c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745648, "uuid": "9d78766f-5e71-4348-8cba-ba75fa066fd7", "comment": "Malware payload (AsyncRAT)", "value": "330d396d018e2d9cb36cf57a0ad654dc52587572c9d15ba62ae520976c92f3d0ad8cee29fd93d2bfc672867fffd6e007", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745648, "uuid": "d6abe757-24ea-4b97-83c4-36b73cd27168", "value": "T1F7E24C4877E44312C5FEAFF02DF3710A1675E11B9923EB5E0CD8CA962B639C146507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745648, "uuid": "c87efad7-0c39-4718-94b8-fa11ef864395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745648, "uuid": "85fe7613-f6bb-4ce1-a345-8d416430a6cd", "value": "768:GxC3fOJ5y8vGFbO75iFDFo9jUnOjhcbe:uCPOe8+bO75iZFo9jUnOjKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745648, "uuid": "0f4e6da7-bcc6-4d0e-a020-a2db7dd94130", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745648, "uuid": "755cfa4e-2c70-4f15-a9cd-eec0b5b522a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745648, "uuid": "fb966f10-b3ec-46f1-a7ad-c2fa8ba61427", "value": "85a1f1233894080f2ad174004d240fec588ec2c941824f71ca10b4e65602b50b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66574227-d02a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764754097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754097, "uuid": "eddee04f-6d50-4ea9-8693-cc2034704dac", "comment": "Malware payload (Mirai)", "value": "8c7515614780c63f34531626fb4bff56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754097, "uuid": "e2042b60-aacd-4161-80d0-0a892e56b52d", "comment": "Malware payload (Mirai)", "value": "85be16ba62523d1e7c7e7b167a6b9038d05b4f7d2acd1332bd5c85145a9c8e15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754097, "uuid": "152e4f9c-f0a3-418e-968b-3596d81c2dd9", "comment": "Malware payload (Mirai)", "value": "bf8224e19d1671dc32b64745002dea8a8a599b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754097, "uuid": "660bc9f6-b286-4736-ae86-cf98526d013b", "comment": "Malware payload (Mirai)", "value": "b05207184960ce5bf48e96c74df9f864026ae7d8c176411ebcc9b3c16180a4a7a8236d4dd0373e70972e3eb37fcf0093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754097, "uuid": "398bc310-2e50-4ef7-bfe7-17f2d5f6831a", "value": "T1E2B34CC4E643D4F9FC4214742176FB37DE76E1BE2228DE83DBA49A329C56581C40AADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754097, "uuid": "c0a665f0-1a88-4485-990d-b7cabcdd11e9", "value": "1536:XM+4+1StCvpD/kYfqKJJNgnMANXYSUjyj0V+LpnqGymK2WdsR3vZ3ID8F5hkmZix:T1xx3JJNgnMAdYSU/+Lp2Q3vNI4x5ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764754097, "uuid": "3c0d01bd-122c-4481-88d8-a4c39d15fcbf", "value": 108016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764754097, "uuid": "04120005-826e-4937-86f9-a38bc1138e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754097, "uuid": "ec14711c-9ca1-4b68-829d-68f949aa93a6", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825f8842-d0a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764805254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805254, "uuid": "7e45e0e1-205c-4e53-b7b2-01ba419a716d", "comment": "Malware payload (Mirai)", "value": "4b264320020286b3b25155878368819d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805254, "uuid": "8c899f0e-681a-43af-b60c-598a819e79a5", "comment": "Malware payload (Mirai)", "value": "85d931de0b2cce4019fbf2bf6e09f39de05ba99702d79bf72fa6d527a0658a68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805254, "uuid": "07b95b45-f807-4571-ab24-4b8f82e9492b", "comment": "Malware payload (Mirai)", "value": "435e2a8efbff3f95912e41f823d141bd23ba0bf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805254, "uuid": "34e24edf-a716-4be1-80c4-ea0c8381825a", "comment": "Malware payload (Mirai)", "value": "57a88737a585c78b7b571965c57b17eec04f3c0e40f3f7d493083354e95741f35b924fbaaa0c6bba2d0285fc394d1c7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805254, "uuid": "fdad624c-5a4c-46ab-bbce-d7d9408bb5c9", "value": "T1D763011D659699B147A10A3BEC9C4BD7F48E2FF0423FE93228508EC989EB00A5DF5587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805254, "uuid": "c72c7043-c84d-4a02-ba31-06c9a1bc2953", "value": "1536:5Im9EOEIUr4TD+G7O+tbc4O+J9LoKfrHDv:OcFEIU2D7OKbrVJ9LoKjHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764805254, "uuid": "2356de26-ebb3-4bab-8ce8-ad4fa67a4ad1", "value": 72288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764805254, "uuid": "a4da6ebb-2613-4948-914f-8d47c7d67ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805254, "uuid": "2331577e-325e-484d-906d-bd1129e3605a", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aad2e81-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764781860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781860, "uuid": "f5ce3334-7cba-4120-90c8-45e6477da7d3", "comment": "Malware payload (Mirai)", "value": "951b2ec8e4a75af4106d0c1a2806afa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781860, "uuid": "747958f4-713f-45e0-b076-7dcf035e4141", "comment": "Malware payload (Mirai)", "value": "85e693f744d7d39903d77827ee449b3faee30b092deeb1d9d7391b452444e4f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781860, "uuid": "f8b3a12d-43c5-4532-9e7e-a31aa2a29888", "comment": "Malware payload (Mirai)", "value": "1e48ff44e7c5352cbfb5fda56ebae749958eff50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781860, "uuid": "22e3710a-0709-49b2-86bc-ad3bae6b52a5", "comment": "Malware payload (Mirai)", "value": "47b5944974c7ea7b4dc0bab0f7e10b0091688b513ba07f425c97a28432e91bff1de6ad000230fc84613a5e9aca99b4b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781860, "uuid": "0132bf86-a74c-4c49-ab32-feafb2458773", "value": "T1458329796542B7FCE9F79034F80310E2289207683BACE1D3A493417BFFB5348A526D66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781860, "uuid": "33790271-c8f8-4e76-b2df-1069f274c8ce", "value": "768:+zuyQV74dSz/mdaTNSM3ejKwvr4pgLJooV3uLxxd5jX2ZvB:+JRSzBHTwvr4pIr3uLxxd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764781860, "uuid": "4542e323-f3c5-4e92-a2ed-7ee798795343", "value": 83616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764781860, "uuid": "4cf3e0c3-155d-4bd9-8199-affeb21c2f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781860, "uuid": "6fa48c93-3e3c-47bd-b4f3-5316db4a5288", "value": "Yboats.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f24d6eb-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746864, "uuid": "384bfad0-8fcb-4ec9-b242-4e5a68a7fcd9", "comment": "Malware payload (Mirai)", "value": "d22624f49ed84b1a38a80d70d117f11f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746864, "uuid": "c5dea683-ff5b-4a98-9240-2f6d9372da9e", "comment": "Malware payload (Mirai)", "value": "86ab2ef7ba5d88e3f63a94e0b3793a604980832c62a787724befc5410b0e437d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746864, "uuid": "f5fb2b96-6094-441b-b7f6-9d013739c0b5", "comment": "Malware payload (Mirai)", "value": "7588b976e6bab8f03386d890248cd9748b8082a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746864, "uuid": "6a706c57-22bc-497c-b4de-aa8346ac1268", "comment": "Malware payload (Mirai)", "value": "8a227a1e318397213ff7947db8846959aaa016a8273cee86f2a37a6904d46ce1a53395f4ed0e77dc819881281b91f0b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746864, "uuid": "8f40b8c2-1a91-461d-a16d-8c77657d65a0", "value": "T133F3E80AEB710FF7EC9FCD3705A91746249C581622A82F727634D46CF68B28F25D3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746864, "uuid": "e438badd-dcea-4379-ba5c-e73469d1106b", "value": "3072:ggaoIg1RrQtcAnNL6JimWeuXvftqfwfh:ioF1RqNNC0qfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746864, "uuid": "39ea4813-ccf1-420f-96f9-ace79b8f078e", "value": 159280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746864, "uuid": "8f0a2704-4a32-4360-8ebe-6f16c1c31d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746864, "uuid": "8f06cb5c-5ec4-49a4-a42e-c560d4a3d387", "value": "Yboats.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75923273-d055-11f0-a129-42010a9c0007", "comment": "Malware payload (Havoc)", "timestamp": 1764772591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772591, "uuid": "a01f7e62-f71f-4ae3-947a-6598661551b0", "comment": "Malware payload (Havoc)", "value": "23510ac78a9f18f81796b5b4e655742d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772591, "uuid": "e3258b85-3fb7-45e7-ad60-57074e9d624d", "comment": "Malware payload (Havoc)", "value": "86d1ba178ae4f79243051c3b4e7a9beea2395e9ef0c8e2af930e32a51ec83b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772591, "uuid": "0811a7ab-67e9-4ae4-96e2-33381db8ec56", "comment": "Malware payload (Havoc)", "value": "25d57ca339010e8a917595a252007cdb0b9f81d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772591, "uuid": "8442c73b-ef3e-411d-b251-41d5d2ad7cc8", "comment": "Malware payload (Havoc)", "value": "b86fe9fb9b9f0304a37bb3fef77628795bba43271d62ee5be5e2a3ce25c3833e261e072e03ecb66742225c4fb23cf738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772591, "uuid": "dcd79b5f-28b4-4816-adcb-372589c6d534", "value": "T1ABC318BBE1441F2EF6260E79024951C5F4DBDBB45D07010AF39AF910F21E981BE99F98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772591, "uuid": "49131dcd-58fc-4469-a436-543cda1769a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772591, "uuid": "c67532d8-30fa-4b8b-9c30-b8e833dc6dbc", "value": "1536:RPo1aYDIuhQU6tWGZBgAlJRpXdEuQLFoefXpwM7CTe142zpuYRyFP4Bz:5o1zDfOU6t9ZddELLyi9ww42zpulFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772591, "uuid": "ee2375cb-533f-4125-8892-c575aad0f483", "value": 121296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772591, "uuid": "5cf17541-3052-4771-b09e-65c22c12f84e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772591, "uuid": "a57346d1-0fb5-4080-9292-3fc4a012e461", "value": "23510ac78a9f18f81796b5b4e655742d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3e665c-d081-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764791496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791496, "uuid": "73c472bc-513a-4449-a07c-ba11f8de6238", "comment": "Malware payload", "value": "00b02c12df9e82202963e7090dc5c034", "object_relation": "md5", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791496, "uuid": "655714fd-d16b-4d77-a99f-d29a3cab7348", "comment": "Malware payload", "value": "86d98c6b9a1f0fdee1fd1f898b8799180a7c9368e6b365a95ede0d8f49a6ad41", "object_relation": "sha256", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791496, "uuid": "dfdd2e53-b0a3-48d1-acda-d4f63626e10d", "comment": "Malware payload", "value": "464017cb83b085d66ee577590a17440fc149573e", "object_relation": "sha1", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791496, "uuid": "773e756c-8c94-4512-bfcf-6c660863b238", "comment": "Malware payload", "value": "65a3e481f1501f9cc563003e417ffbd0a09fa2245eabf12808c2c9833f0c640573103326fe3ebd38a16e0f55c7359db1", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-219-23", "colour": "#CF0D26", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791496, "uuid": "6e9286b0-a8c5-40f6-8eb0-3123b11dc25a", "value": "T17A35231256C8E932E4EA2B7028FA03930A37FDF14998D3663E45165F8DB3384A57573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791496, "uuid": "629169d6-f386-41ea-ae6e-7d2546f7e9c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791496, "uuid": "9a9c61aa-ed01-47d9-95d8-780cec7bd2c6", "value": "24576:TyfibjWwiHI8APdqT+j6fe9efPHlAPEXSAKb2C3moiVFp6Y:m6ewi9T+SAcXiC9Vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764791496, "uuid": "f5e00fea-afa0-4486-a864-235cd9c7a07b", "value": 1153192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764791496, "uuid": "b17cc416-7055-4616-a3d1-35e80e3cbbb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791496, "uuid": "cb134c9d-4aea-4fe7-9107-7fd6f7f4e3c4", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61d380d-d02c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764755170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755170, "uuid": "6f3de59d-8c2a-493d-a45e-01443acefc86", "comment": "Malware payload", "value": "060328b9775ad99784d419ca1c181ced", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755170, "uuid": "1b11c0ca-5406-45f2-899c-e4199b227eaf", "comment": "Malware payload", "value": "876a04d0f76dc14f68248e0b4498e3b710740e1447bcc6be6fd746b9c01276de", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755170, "uuid": "00a875e2-c219-4d90-94c7-7bc5bbcc75f8", "comment": "Malware payload", "value": "d0c87ab444282ae44222f442092748b2b38bcdcb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755170, "uuid": "e461deaa-e6a6-4322-9815-3a2a06cb0e7f", "comment": "Malware payload", "value": "95158018e737348810487a411422513166dd2ae62f535b3cffdef51b8f7436a59162157136c8a41267d344d0c8ff9ef0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755170, "uuid": "ad2270cf-2e9a-4373-ace6-38dfafc2dc60", "value": "T1531733833952DF27D0A132B5186FCE1D4E65AC19FBBCA477274E7F4161B061E2A4833A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755170, "uuid": "b99e56bf-db5c-41d4-8b49-8ad7475625ac", "value": "393216:oNfLWlAK76EUmZeuNN9oTO0wzE1BoYlZTdwmMXeHc:oNSlAK7BZlNN9oMzoHlZTdae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764755170, "uuid": "2316106c-9e21-4d94-8c6f-400cd7b55b1c", "value": 20004864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764755170, "uuid": "94bb2cf5-0634-4079-ade5-be340ec6b8ac", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755170, "uuid": "ff325ad0-c909-43a7-b86e-b76fd27aa878", "value": "QuickSoftAI.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08490b77-d023-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1764750932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750932, "uuid": "c82ad464-d2f3-4db0-a145-b48998c4da94", "comment": "Malware payload (DarkTortilla)", "value": "ef56ceeddf5ba59ac0fa0d5b195932f0", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750932, "uuid": "118a880c-1396-4545-9f01-1f2d808c66ed", "comment": "Malware payload (DarkTortilla)", "value": "87fe3267b683590bfefe5041835233c058dfcc764e427f201fa550cd89fb3133", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750932, "uuid": "4e07f1a0-6749-4538-aa3e-01b00aaa4363", "comment": "Malware payload (DarkTortilla)", "value": "06b0902a31ce2a1b1702e29e87f6d7c0205f9a32", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750932, "uuid": "2c5735c4-d79f-4c16-b815-837616b3fb6e", "comment": "Malware payload (DarkTortilla)", "value": "71e4a801d56597a0ff2cc9e51956041f2b14a82091d82244ade99c3967cdfb88d2919165d9f89003ac81fb745dd49dfe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750932, "uuid": "15ecf88a-da83-47ee-9055-bc9eb62d6ac5", "value": "T10735F11A17D55FA0E0BE8B36E2B0405443F0BA1B8637E36E7E0852FD8E2179B55D2367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750932, "uuid": "52a40818-b321-41b3-88c5-083dc8e214dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750932, "uuid": "018f29b2-298d-4ad2-9481-287fad7c70c4", "value": "24576:bPzNDTTHJGBp2jEjCAapOiSY7joYgd9E2Q62r:HBPHJGv2jEjupdSY7jVgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750932, "uuid": "4ee266d6-bad5-4fa3-bf47-2d551dd6ed82", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750932, "uuid": "a54eab08-c9e9-4615-bbab-ec91710155d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750932, "uuid": "a1170208-a775-4d6f-8db6-d157186d2325", "value": "anewwwchybike.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e2b374-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736695, "uuid": "7fe6c2df-6dcd-45d6-8e78-42039a0876c4", "comment": "Malware payload (Mirai)", "value": "6e7cdca6438fa23d39843aa30dcdb3cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736695, "uuid": "526c0166-5bf6-4e47-a472-c001503008f3", "comment": "Malware payload (Mirai)", "value": "88a5284e84b58227db0e83749b4bee2ffd2b0df8c08f5b122172997ceaf8078f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736695, "uuid": "756cf57d-eaa3-4cce-9823-284f81375f5f", "comment": "Malware payload (Mirai)", "value": "478d72b2896f6ddaa1a8acfef25fdd5bc0a28bf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736695, "uuid": "5c967bfa-7a14-4a24-8c2e-002aca8a6171", "comment": "Malware payload (Mirai)", "value": "aabdd51fa3e8f44b36adb8a7c297de4e8d8baf244304e99381d954e33f72d09521d390a4951c85bccf44b82840a4f4a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736695, "uuid": "f71ca704-cba9-42a6-a070-8b1ee6f749fa", "value": "T11A834A85FB43D0F2F9430572113B9733C733E5390029EA92D76AA93AED52951AB1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736695, "uuid": "db77979e-58ea-44bd-a19a-a9b7f3a479cb", "value": "768:dhZC00eYcGL7dDXfTYM9qqOlJjz1Js6ivTwjqqBvhZDz8cJEamBs5+9FsnRYSbUy:D9DKLpzGqOl1HlqqB7VllYEeS4tx/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736695, "uuid": "9ec8ef3e-4457-47a7-99f7-41cbabc41a91", "value": 84140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736695, "uuid": "5180f9e5-96db-4a2b-b365-6ddc67b8b10f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736695, "uuid": "1a3ba525-9366-4023-b4ab-40fd81ad421c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de17a96-d041-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763827, "uuid": "52cb1e63-b1f1-41c4-8bf1-3fefe2fe3639", "comment": "Malware payload (Mirai)", "value": "184fc61b460eb3a2805eec3dedd4d712", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763827, "uuid": "a4e3beff-701a-4539-94bd-4ea02fcde8cd", "comment": "Malware payload (Mirai)", "value": "89e8b14525ee72a98c9bcdcf2dfac0121faaa52c9d871bf8a7e9188e8f173419", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763827, "uuid": "96264388-f5b9-49d6-b72f-4889234cc9de", "comment": "Malware payload (Mirai)", "value": "050d3265192d5931ecf7ad8eb7d29f2e1d516eb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763827, "uuid": "fce9788b-9c91-4e1d-a730-a8d333287d6a", "comment": "Malware payload (Mirai)", "value": "3f2e40ed00a16b2a8f7e42d02784cae8fb4639895a219d87049e0e0b0ad4987b47da351ca8fd00ba68f7fdc7e84cc63d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763827, "uuid": "bfd4076a-6a4b-448c-ab03-8f2b750ba880", "value": "T1E3246D46AA908F13C5D2277AF69F414933329764D3E7B3068D286FB43B8766E4E37205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763827, "uuid": "ed63b6ca-3631-4ae2-9228-4ecdeacead41", "value": "6144:+5qymIh6+Hlbhl6aAHt1Sn4soZET45M/9NhTpF/:+5qynhfnl6aAHt1Sn4hlu/9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763827, "uuid": "ab202789-1c3a-43e5-855f-641f0a8b30b3", "value": 214629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763827, "uuid": "e351476f-a7f2-46c5-a8e6-8c9bcf2ed63b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763827, "uuid": "a8905512-3012-467b-b86f-e88c51787bc3", "value": "Yboats.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7a8d2b-d045-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764765836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765836, "uuid": "690c0d26-3fbf-42e7-b64c-8a7255920da8", "comment": "Malware payload (ConnectWise)", "value": "5c939b76d008e063ae223a3a21c1f66c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PANTALACCI-ESSINDI-EDANG", "colour": "#DEC13F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sushigoku-io", "colour": "#A3935A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765836, "uuid": "230a6643-27d7-468f-b13c-a6f2fa1172f3", "comment": "Malware payload (ConnectWise)", "value": "89ff68d2f4790bc23a3cd8860c9aa5c055ef2d133ae4de62d655ab778774f407", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PANTALACCI-ESSINDI-EDANG", "colour": "#DEC13F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sushigoku-io", "colour": "#A3935A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765836, "uuid": "92225a8c-1d35-4227-a7f2-4aac4ca6f4e4", "comment": "Malware payload (ConnectWise)", "value": "d12442f5ddf9733b9ff602467ba640a7914cafb3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PANTALACCI-ESSINDI-EDANG", "colour": "#DEC13F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sushigoku-io", "colour": "#A3935A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765836, "uuid": "85d63549-53d1-4510-88b5-e50f9edeb9e3", "comment": "Malware payload (ConnectWise)", "value": "2683ce4854e585d678f8080551b03acc4a41279646e3f80a56b098352a851d55f52061c114facab6ffa3c61fe17a22ce", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PANTALACCI-ESSINDI-EDANG", "colour": "#DEC13F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sushigoku-io", "colour": "#A3935A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765836, "uuid": "62fe7390-0330-4170-ae77-ade4629b6b85", "value": "T106A6223267F94918E1B36778E93991F295367C65CF12C08F2764786E6870E8097A333B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765836, "uuid": "ea2e3d97-b9d7-4e52-a7b4-4edeaa02bde4", "value": "196608:brnLYG3zKhukOlrnLYG3zvrnLYG3zqrnLYG3zVrnLYG3z:bbDDKgvlbDDvbDDqbDDVbDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764765836, "uuid": "bb8b366f-669b-45fc-8d0f-3564c71f5406", "value": 9977856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764765836, "uuid": "789631ca-7cfe-48be-a754-87aacab6dfb5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765836, "uuid": "0a4bee34-6363-413c-8259-9e5be649a4b3", "value": "89ff68d2f4790bc23a3cd8860c9aa5c055ef2d133ae4de62d655ab778774f407.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e327bd53-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749582, "uuid": "25cfcf0f-5c7a-4ccf-bbb1-ecac5046f23a", "comment": "Malware payload", "value": "6b71f46019d2e7959d829eace8ab0ccb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749582, "uuid": "cd7acb0f-130b-461c-91a0-d4d2c33b829c", "comment": "Malware payload", "value": "8adce5e888db7e35a5731de025715c95961b459481edd19a2e7fb040c1218063", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749582, "uuid": "b00f754c-9106-4b4d-b40c-9b2ea724bbfa", "comment": "Malware payload", "value": "06535fbbcf219c3727445e39d1075935a5df0e2d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749582, "uuid": "965a8c45-d20e-4232-884c-52fcf00f12ca", "comment": "Malware payload", "value": "97e6481a5dd081a3ac4f953a5176205f5a3af8b682495456331cc1e20f8e367d42be947c4f5247905fb4c5c3ef751c0d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749582, "uuid": "9b04c12d-3a60-488a-83ff-eac4699d7508", "value": "T102261249F308A62FC5B794334AB6023612574E8BA946D7535964B22C5DBBEC04F8BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749582, "uuid": "3fe0ca34-fe9c-4b11-bf5e-8a9727ef0e60", "value": "98304:QN4zIk9Oav3CP3yjz5KqvzKFnujkH9AC2TIb+BD+7sL3Y0xCAr:QNCIk2fs1KQiuA4IyD+7sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749582, "uuid": "22268b2e-cf45-4da1-abca-82454470ebb3", "value": 4849694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749582, "uuid": "ce35ffbf-1923-485c-8b7f-df1b49dd4481", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749582, "uuid": "0118f004-a7d4-4328-9f59-b25551873a61", "value": "min_ugit_1.0.4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e042d7fd-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749577, "uuid": "7c9b4589-b399-4c42-a91b-dac9b5cc6766", "comment": "Malware payload", "value": "c6434b54c1170b7f2de513882dc91afc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749577, "uuid": "032314a5-94a9-4a99-a07e-740668aa50f5", "comment": "Malware payload", "value": "8b4f2b4ee06b2963ab302eb9f42cb37884c0caa6bb1f4c3b279cf18db1552ac3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749577, "uuid": "785b3940-d179-4f84-b817-fe501b2ad5cf", "comment": "Malware payload", "value": "76af5af55e0ce7befeb5658698f725de1e16b351", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749577, "uuid": "7cf373d0-28c1-4146-bbeb-83563ac02cff", "comment": "Malware payload", "value": "39ede697e113ec1dc13415da6b64c1f126ae2a7d0bc3bacc093214fd7c7c5e7104d5bd56e25b012fbcb120d5ebba78e5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749577, "uuid": "06d5454a-1144-46e7-9de8-a667d2a25622", "value": "T15EA733D3F738592ED8B341724C5D9236AE194D10CA47AB0B3B047B2C6973AD81F89BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749577, "uuid": "65c9c834-53bf-464a-a2c7-5b7c50f7fc21", "value": "786432:EYC2nj7KzWPzHYdZqpbJmeZbb1y6GT0u/GEgoCz64L4Yju:EYC2vKyPzHgeH51yj5/Ge4L4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749577, "uuid": "46745d22-fa6a-40e1-94be-349908ca24b2", "value": 43756798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749577, "uuid": "e281852a-2060-433a-b862-6d81ce306d2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749577, "uuid": "444e5d63-a2c1-40f4-8ebc-d59986646ddc", "value": "unitv-celular.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dca636-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764768048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768048, "uuid": "38371813-b1cd-4ec9-bcd4-6eda51a72cc4", "comment": "Malware payload (ConnectWise)", "value": "91ff4ae4afc15bb658d88dbd7a1051ae", "object_relation": "md5", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768048, "uuid": "9af9fd38-bb8d-4bd2-ac67-bce9b68133bf", "comment": "Malware payload (ConnectWise)", "value": "8bc07575854bba3474e1eb3451d050d4f1386097fcbd6343d0f4c53bf1efc780", "object_relation": "sha256", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768048, "uuid": "5dd82d07-af7f-4937-b508-b18c4b8cb1f4", "comment": "Malware payload (ConnectWise)", "value": "0b7e7ea49bee4073d5598b7ae6cdffa2f170d1ef", "object_relation": "sha1", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768048, "uuid": "2727452d-8ce1-41a1-aa93-9e3129fdb831", "comment": "Malware payload (ConnectWise)", "value": "6713517b7522416cbcb50f7ca21c5c5376ecb297d7b02d78aed88a4ac607e3910f8d59c8aabafed05b0fb21385e3bbc2", "object_relation": "sha3-384", "Tag": [ { "name": "45-83-28-172", "colour": "#08639B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768048, "uuid": "05fd5173-5cb8-4fa3-b9a4-000c9593aa2f", "value": "T1F1F5E02173E4C136D0BF0A39D8B94561A7B5BC099266C75F53A47D6D3E73B808A223B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768048, "uuid": "ddc973ed-f109-484f-a23f-b114a90ba6c3", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768048, "uuid": "3f9b1e2b-ce32-40b4-9e95-6e0a53e146f1", "value": "49152:XZwPTPFIST0+TL3Z0Mi963PSugQeccp6EsToWTn1Yt+fLbXGundZRT4T1gn:XZkyZ16MAEsToWT18+vGWkTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764768048, "uuid": "791bac99-c949-496e-b2df-48490a2e9577", "value": 3323024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764768048, "uuid": "eafefa5d-d75a-41cc-ba0a-05cd896c1296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768048, "uuid": "bdf30f9c-d35c-4598-a2d7-e35376df0061", "value": "8bc07575854bba3474e1eb3451d050d4f1386097fcbd6343d0f4c53bf1efc780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5a732a-d099-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764801779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801779, "uuid": "e02ec441-4cd6-4873-a4c3-f635f2979c28", "comment": "Malware payload (Mirai)", "value": "bf9d2ef00c3bd9e8c36b5d695804cd76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801779, "uuid": "5c8d466d-f4a7-4615-8aff-30a26c9c50c2", "comment": "Malware payload (Mirai)", "value": "8c45280bdf1bbb9840dde3dd4ddbf30b2bb42a67da3fc793eedb3d3ffffca0c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801779, "uuid": "65d2948b-511f-4533-98c8-180d92e25f28", "comment": "Malware payload (Mirai)", "value": "a7d96ce7900e65461dc03fcae2c99c28cd6268ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801779, "uuid": "5a86d3da-9223-4f93-baff-d4587d535295", "comment": "Malware payload (Mirai)", "value": "209b9733cccbf2f6a50d177f4bf73158b0a30e6adcfc03c497fc5e34094849ee106f333ef1bfe589cd72611bbdd4aed5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801779, "uuid": "f0cca0f3-7834-4424-b64f-77cbaa88930d", "value": "T1BE23F1FEEA142D9BDCFD28A2054F2F164914A0C371830EDE531BB9451D3B696B48A8F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801779, "uuid": "f2c182b5-e950-41c7-997f-67f14536298a", "value": "1536:0vVh/XS22iJP6kGQrXnzQ6wuSmRfOhrxI5a0T2PPw9Y5x:0vVh/XLx6kGQzzQ7dmRm1WRTyw9sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764801779, "uuid": "8cc9b111-e815-4745-9c17-0a5ac119ead9", "value": 49604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764801779, "uuid": "6956e951-9448-4ace-be2e-0ba76d350a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801779, "uuid": "850cf4da-cdf8-485f-ac28-afbfbbfc0bfa", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b596ce-d09a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764802305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802305, "uuid": "6bdb11ec-c587-44e9-a01d-606cbf5b3502", "comment": "Malware payload", "value": "62c685905ad3868301768cdb0460c758", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802305, "uuid": "8ab3d7a2-08cf-4057-ab6a-bc5f1905eebc", "comment": "Malware payload", "value": "8cad6be7466208c5267a225bac0c15e353cc68cd620fd61630c7f8d57e8d6da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802305, "uuid": "922e7420-a3a1-464a-b449-3de6e6034cb0", "comment": "Malware payload", "value": "927e6f7fe621e79b8922ad15453bf68bd1df390f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802305, "uuid": "a07806c3-6365-4e88-b797-eb4f3826a449", "comment": "Malware payload", "value": "8b444a1ef76edae1dfe927a167400ad0bed78dfb482fa77db337ec428bac2a254ded0c3fd20145655b9f425a13f9c0d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802305, "uuid": "98f44490-55e7-4940-a3a3-00bdccb813b5", "value": "T12732BF89BA16E6E9F6145CF37C2C45BC89ABF26F0966307148E5B84CCA454EB0E0F7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802305, "uuid": "4699e517-8dae-44cf-9977-5d5d2deab8f8", "value": "192:fTu2PzRurki7SLDLVpVovt9SbVySN6TQ3JuGpymy/qD1zIWRzYFbYWv2:flzEBkDOvTCZuQEkymy/Gf+32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764802305, "uuid": "026dc01a-35ea-4808-8c00-61252da993b8", "value": 11424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764802305, "uuid": "bd180490-1185-4d75-9cc1-0d40ee9be306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802305, "uuid": "3c8b094a-975f-48f3-b779-f6a71cb7fb63", "value": "SecuriteInfo.com.Linux.Packed.2018.2143.11677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788f548c-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764736518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736518, "uuid": "8fa4d599-f056-4e3c-a19c-4363b9741167", "comment": "Malware payload (AgentTesla)", "value": "6daf2c1df3ca6ade23d130d53454959b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736518, "uuid": "3c9dd2aa-d8ee-4b88-ae40-cba445635f4e", "comment": "Malware payload (AgentTesla)", "value": "8cf5f3e9a07f1dd62a7ba26a79f035d17e8c9f60c0d00efc450f2336328a2563", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736518, "uuid": "4c5309c5-3013-49b3-aec7-49ba83ccadad", "comment": "Malware payload (AgentTesla)", "value": "57d7147128949531cde1e28f43ac2789417dd35b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736518, "uuid": "2f0d4261-634e-43a6-a507-fe3af84b44fe", "comment": "Malware payload (AgentTesla)", "value": "b8b1882e5a3cdf841cb18af4fe6fa023f0cfaef8a54c3e76f82b37def442484b1d3af8d1b30ca6a41cf65b11cff74940", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736518, "uuid": "618eb182-3c20-4214-b0f2-f89330c44259", "value": "T1D5A42318C62A9303A5A738E30E1C8E4DE07526398E4E59C83DD433DF619A93F9DF1616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736518, "uuid": "b609e442-27bb-4093-8f15-540100ba9ce3", "value": "12288:PhGJCbTiYbQQIhQ3YNQ29+3wTlsRdmCnNguO5S:P483E63YQJgMd/nNdGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736518, "uuid": "db100b65-8650-4526-ad38-ae959fa0d72e", "value": 484528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736518, "uuid": "952a324f-b143-4948-9863-b6ae3bc102b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736518, "uuid": "d893bc22-16ab-4ec8-9b44-b1f7b981a775", "value": "708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93fac5e-d019-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764746908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746908, "uuid": "ec4e806c-8e2a-41d6-8cac-e960718385e2", "comment": "Malware payload", "value": "1884ba96f98a95485d49fbf6bc6b328c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746908, "uuid": "5f1de0b8-1e22-4001-a680-1ee715dcf935", "comment": "Malware payload", "value": "8e7b35a6460a4187530fe381d9e3af0568fb08cde474eccdd22c79e7d53625fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746908, "uuid": "d4d62d31-2a29-46e2-aeff-fefdc464a2e7", "comment": "Malware payload", "value": "a1a04a03e429f14f6565e852e2fd8dc5f43c0f93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746908, "uuid": "d03c2011-bcd4-4fc1-9aba-a9184299bb01", "comment": "Malware payload", "value": "254d90b3e0b2f848c29359462568cf6f639467ac822041a0001d84f3d76687abadc608e22443ff65ac6d336bc2aff14f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746908, "uuid": "32632b1e-dc6c-4120-bb6c-7f75b5818742", "value": "T18F95224E6908C403E0159AB55AE7D2FA2722BDA87810DD379DD0BEC3B6BE2941915FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746908, "uuid": "691b9840-707a-4716-a69d-d526f6c5b79e", "value": "49152:wHSZLKUkQQLA6epYAZTgciOzij2NKzHB5KyPXZOm:2SZ2tgpYAZ8citjaSLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746908, "uuid": "4f7f65cc-029b-4624-8636-38797e572e26", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746908, "uuid": "e47fb5ce-09f1-4ce8-bd1e-4546c2aafa20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746908, "uuid": "62737000-2f00-4ca5-90c3-1f2d595dee7c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.29281553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092c3507-d05a-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1764774556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774556, "uuid": "f7307846-fed2-48c3-8a98-27e7fb7ab8f0", "comment": "Malware payload (OffLoader)", "value": "2e095bb3494d80f20c6f12c4798ef3b6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774556, "uuid": "f6d598af-d58f-45cf-8980-731665d13756", "comment": "Malware payload (OffLoader)", "value": "8e94849692519ab0f0b33cda20cadee491dc50c07ed1aec60fd31e3119f30abb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774556, "uuid": "c7e648db-c39d-4ab4-b4f8-a00549adebcb", "comment": "Malware payload (OffLoader)", "value": "e925130b4a31f86730eb50d22f8b74a4e9fce2cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774556, "uuid": "70e609bc-3271-45f1-aa57-adc431614c97", "comment": "Malware payload (OffLoader)", "value": "466cd8870d60159f3bd673afd60a5a8cdb43a644f8d46ea6fe8dc913ef6ca131c9fafe9b09999da51fb68707acca1aef", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774556, "uuid": "36757038-202a-4c4a-872a-ce7d76d22890", "value": "T107057C03F69A81E8D55EC07CCB9B5232B777B89D4A3072EA36981F283D57E906E0D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774556, "uuid": "afc4913a-0a94-4b5f-96aa-781b338bec15", "value": "a4f7949d98faf190e6c60b297f05a709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774556, "uuid": "d81efecb-0b30-4121-9c4b-b0a6bbbd3c5d", "value": "12288:3X37ZEdRkuiaMBregjDvXaUP5ivgtXHJlt2PqhPm:LGg3aMoMqUPyg5nVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764774556, "uuid": "69d79b73-a9f0-47a2-8621-b41c24d5c71b", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764774556, "uuid": "444b4806-dde1-4531-a38c-0a4d80f174ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774556, "uuid": "a66946b2-f0a1-4a72-b5be-7ab807846c9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22ea558-d080-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764791134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791134, "uuid": "6ec9db4b-0d9c-4ce0-a0ff-959ce7e82532", "comment": "Malware payload", "value": "f39707848865593bac48d83d490ff86d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791134, "uuid": "abf7a1a5-d680-42cd-aef8-89a46234d515", "comment": "Malware payload", "value": "8f20209a07c8fadfbdda7d28786abdf0fedb7bb83b104e2ea458ffda0840c1ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791134, "uuid": "5a022647-0e38-4db5-b18b-8ec5070b2200", "comment": "Malware payload", "value": "48cf4ffa957c24cc1027064f6ba4da3221e7c3c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791134, "uuid": "e1345f9b-e860-44d7-8f7e-97c99d206efa", "comment": "Malware payload", "value": "bb4459ddef98cbeca808bc359d09ec9643add0730344f5ecde3eaf4103623e66344442f757009e450b6f486c1d933da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791134, "uuid": "5834b967-bbf2-4ec0-9be4-e31bc8b3ce00", "value": "T11DC60903E89611A9C4EAD1B489214162FA707C5C0B7833DB6BA1F7B52B337F05E7A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791134, "uuid": "dc213b33-d0c9-4111-adf6-e847b74656fb", "value": "49152:7fJlEqJT/n0fwzofmICn36XhWzT5ePlUxg+oiS+BeKWFvSwuaEe9U2QBym/zE0cZ:ncVzC36xumKWUzaTbVQZ4Esoy/rX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764791134, "uuid": "30498a6c-7bbc-4b8b-ab11-99233cc34d77", "value": 12513280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764791134, "uuid": "68e3bc0d-7d0e-4467-bb85-0924e69899a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791134, "uuid": "9895dad1-f83b-4417-8dfa-9e1828fd3430", "value": "crond", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20afec64-cffe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735082, "uuid": "39ab5294-86b6-4240-bcc6-e441877fab25", "comment": "Malware payload (Mirai)", "value": "098ecb0f5f129dd82490651aa9d63aa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735082, "uuid": "2459da57-ae1a-40ca-b59f-37a4f1072c81", "comment": "Malware payload (Mirai)", "value": "8fb269861c3051a8cace7e441de6e34f89d7d8d31f48b3884565c7eac6591426", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735082, "uuid": "25467518-7079-4099-974e-9d69f948e1a3", "comment": "Malware payload (Mirai)", "value": "8d86c2f75acc038046419c678ccbcf9ec4676c57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735082, "uuid": "78acb212-3df9-4b73-bbf6-4c2d008872f7", "comment": "Malware payload (Mirai)", "value": "83c6fe967978f21fc05721357b0edfd171aadbf0e56a5d324a9803824731a3526fa0dd8ef127d331d1c10b8bdcbda4fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735082, "uuid": "91246a0a-762c-4744-84e2-da2ab0ef0c32", "value": "T139F2F13CE5A88ACADED7FD38A44095C563806B4EBB50CED07197AF21C281D11BB56CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735082, "uuid": "c62610fb-f6f4-4e53-a09e-67dce9e785d1", "value": "768:wFlknyU6uKSfYxnDJscZSFRkGDQZ8esXSRwP4uVcqgw0IQ:wFAKSfYxnDJlZSFRkrZ8esXl4u+qgw09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735082, "uuid": "f8b64305-170c-4180-95ee-828481616c0a", "value": 36820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735082, "uuid": "219fe9bf-0bb2-4dd5-bb13-1d665a94544a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735082, "uuid": "bf4358a7-aee1-4ff7-bf6c-8b08b6f4fdc3", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e2f3ee-cffd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764734982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764734982, "uuid": "e1a06e22-9d06-4c3f-956a-a71f17f20e14", "comment": "Malware payload", "value": "016f915a32f3ea02336f0c826eeff638", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764734982, "uuid": "6e991b7a-789b-40f7-93fe-342883049d59", "comment": "Malware payload", "value": "8fd0e59a972656a78a5d9828ba4d49b93d1cfcd5b181e17cb2ce7ee9c67d91f9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764734982, "uuid": "af2af622-ed4b-48a9-817d-597bd13abba1", "comment": "Malware payload", "value": "d5c41bca112b6baa06f7d8e82416433b68dfdfa9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764734982, "uuid": "a69e5d7e-de3a-43e2-9dc0-730ff9e6fd23", "comment": "Malware payload", "value": "4a49a32b29ea1f723a6ed1b0a28e7a49f6707df2b4d13a0403a0fc6b7ad2c6f6ff1ed78d44a6c756c66938b2c0971113", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764734982, "uuid": "5fcf964c-db0d-4e2f-a97f-49cb11831518", "value": "T1CEC533BA16B7EC48C8DC5E4D9D6C7CAF9BA977D389D4DB5C482F4282A464C1F802DD20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764734982, "uuid": "f384957a-dd0f-4d99-9268-c1e83a2b4289", "value": "49152:7t95IFnryT9sEX2dOdoZ5DE87aAO/g3yl4qXR92K8PkoJbC9y7uo9WdF2OEOF:P5NTiEX2dOdyakyl4eR921Prbk1nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764734982, "uuid": "6ca19be9-0dad-4b45-ab9c-aac90cfabf8b", "value": 2575667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764734982, "uuid": "e2f8c7b7-3fef-4ba8-a93e-2aa8ff9760f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764734982, "uuid": "b4646535-01c2-4a6d-ba33-bccc96d63138", "value": "Sentry.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93dcaa49-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749449, "uuid": "3e28fd27-a40f-4825-aeb7-399c9f98f9ad", "comment": "Malware payload", "value": "c9a5840aa74394beba3c6d236fec1dc3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749449, "uuid": "bbd0fcff-53e9-48f8-8bd6-70531ec6c83b", "comment": "Malware payload", "value": "907a232e42dfc049991d5625126f5769795bd382d859c14ee7b4b4545e12727e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749449, "uuid": "6c719833-2f1f-461b-bbcf-bdc2ac645ba0", "comment": "Malware payload", "value": "5bf496bd4532ad34bf498d65738ddcf11dd7cab1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749449, "uuid": "1bc7f6e8-d951-4e39-abf8-8d3b15759b23", "comment": "Malware payload", "value": "e9d912398281118d01fb0f7f7e18e23463c408ef2c044d44d7047c8014bbea881108679479af7b825e8d121c544a8c3d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749449, "uuid": "0af7eb0e-5de7-49af-969a-00e102fe05eb", "value": "T10B073362666F04B1E60B4A20B1074B527B49B5734A3A02D18097BFC7B7DF52ED4CCB9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749449, "uuid": "33c691a5-cf92-4d88-9f0d-d9153458b7c7", "value": "393216:WXy4X1Ykhv3KLoSzQ25V8GUOV7QbIqtVrFJbkVDe99ATmgcbrlVMlgm:W1SkhC06QtPOVsJnheGATLcbrUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749449, "uuid": "d25b65b4-cace-4992-9fff-33fc38a13197", "value": 17527104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749449, "uuid": "8ce8ab6a-63e8-4899-9cc2-3055f942ccbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749449, "uuid": "a2957df2-f0b8-40b4-bfd3-601cdd0f1637", "value": "1.21.6-Fabric 0.17.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3191c9f1-d043-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764764746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764746, "uuid": "e31d0532-0a8e-49f5-8f05-06ca5a5cb810", "comment": "Malware payload", "value": "30a73542c2635431173abccc3990532a", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764746, "uuid": "cedb2e66-3c1a-4717-934a-ebb693e44a51", "comment": "Malware payload", "value": "917cd7d985a687b24a03c06244da1cd37b994caa857f129ee5e4696561e88098", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764746, "uuid": "ef2e4343-705b-4d5b-8d18-0c445abacf44", "comment": "Malware payload", "value": "c86b88cfacec433d0768872eb6dd9dc27427fc2e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764746, "uuid": "556ab0d4-8612-42cc-90c0-24a8436b38e3", "comment": "Malware payload", "value": "c094ee1d7fdf52c3743a12ce759415942bf572ed1b91162f1a0eca3ef72506d72168859ee78ce2c8916dc6db34cd92d1", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764746, "uuid": "604721f2-793e-4993-8f89-50e4a6767e43", "value": "T14055BF51F683C072E59102B16476DBBE4A7C6C340762D8D7E3C43EB7D9202D1AF39A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764746, "uuid": "ef0999de-0d63-4eb9-be06-1c0784bbee8a", "value": "23f20f26a15d3def163ec2913c659767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764746, "uuid": "5a1c4f1e-1cd6-4d3d-94f3-d00354265922", "value": "24576:PM4jLq2TFiq9QH6LIV62vaSX6wdwBSwufUWbrviDQXYi:PpXTFi0QdvJX6B7u/viyYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764746, "uuid": "91499039-c431-428b-9f01-ff22cd8c2107", "value": 1303552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764746, "uuid": "5e4142dd-d874-4fcb-a94b-260d794ba73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764746, "uuid": "6df3a95d-2d0b-45bb-b952-7e24e8ec8708", "value": "List of officials nominated for rewards 2025-2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b70499-d099-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764801627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801627, "uuid": "f6c8b490-a92f-430b-a43e-69716a9b9549", "comment": "Malware payload (Mirai)", "value": "4337c9f6d414887d843f5b78e6b1fab5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801627, "uuid": "c06c33f7-b6fe-4006-bc76-9dad8e2ba897", "comment": "Malware payload (Mirai)", "value": "919608b6757d3564cb8b83add128fb797e198632c40720e07479bc683547a396", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801627, "uuid": "25a13221-18e1-4b96-ae77-1a031473d023", "comment": "Malware payload (Mirai)", "value": "af363f4e64dad4580676afa0d372658808c1f306", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801627, "uuid": "132c7186-7794-491c-b40e-be1f596adf70", "comment": "Malware payload (Mirai)", "value": "93f747feea262d8c186fe04315475dd77e4527400423cf97ac851e3aa423c7f34d9ffac0c7ad4100f0f18259878fd496", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801627, "uuid": "faa7c687-00bb-44fe-a1fc-c15ef1a45a68", "value": "T185D38CC1F683D8F6E55640F2252787656B33E43AA026D987E7B92F39DC32980C71636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801627, "uuid": "e27f0425-d637-4a19-883a-611ceba1ec87", "value": "3072:XsBoZfWxMlGSKbjy5SB5Nx/9hMDrqDFmu8OAqHQ6a:XsufWxMlKy5S7Nx1h3kXWQ6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764801627, "uuid": "c3b49d16-2eb2-4866-807d-1f27dc0d14b5", "value": 142092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764801627, "uuid": "fa4d9f18-14bd-4a60-8716-af9caa13df98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801627, "uuid": "771a4681-d021-4dd4-bea1-68a328082628", "value": "sync.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee08aff-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1764770593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770593, "uuid": "2245c4fa-99a4-4372-b87f-ce6d1e657282", "comment": "Malware payload (DBatLoader)", "value": "e3f83ceebfca211deed67d7f5ef5e185", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770593, "uuid": "6cf3f086-d712-426a-9ca4-069f84e8b14f", "comment": "Malware payload (DBatLoader)", "value": "91d7adf38c8940d72640098efb13cfee74bf5195737a093a4a3330af0fb63ed5", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770593, "uuid": "7eadde3d-a767-4754-b02e-b8c59409dd79", "comment": "Malware payload (DBatLoader)", "value": "c1647b2c5035d221413f37609968a1b8f813bf03", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770593, "uuid": "dc06c0ec-9e57-4eb9-9e29-dade597af9e1", "comment": "Malware payload (DBatLoader)", "value": "003b500d91139e09fafc03138af0f7221a67140a88ab33295effda58e84fd6f4ec34c1e97c3ba65384b16943ee23aa09", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770593, "uuid": "d42a5ca2-62be-43d8-a16c-e93008fa696b", "value": "T12E75E162A1F08836E127C9F49C16938A642DBFB43E71A85537DC3F689F365356C260B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770593, "uuid": "40faff93-fc44-45db-8eee-05c445791460", "value": "eb41e5567017c33839f07ebe2eb84cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770593, "uuid": "611f528f-74cc-46a1-aa16-599ab525ac8b", "value": "24576:sbCbz7++IfUFixpw0QB7FqyJjjUYYFynPBJZ5i2qXuh7CSbl2GH:sbiFjbPqyJ8aPBp7eDGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770593, "uuid": "dac28fd5-3181-44d7-9448-a0922ec3a750", "value": 1644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770593, "uuid": "6e363758-93a0-4e57-881c-286d3910dcb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770593, "uuid": "71718c92-a1ba-47d3-9007-da1fb0ae4ae7", "value": "e3f83ceebfca211deed67d7f5ef5e185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb93c43-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764767615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767615, "uuid": "ada26154-8379-424b-a03c-c647753d5f19", "comment": "Malware payload (Vidar)", "value": "3a2b7e12bdcac9f366491f429daf9354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767615, "uuid": "05b957e1-bd82-4300-b85b-c583dbe676b9", "comment": "Malware payload (Vidar)", "value": "922e3dd138b089e66541cc9a3b48284d39f858d3043fe69f515d7339a050b056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767615, "uuid": "6e91d1ef-92ea-426d-a5d8-7490db5b4558", "comment": "Malware payload (Vidar)", "value": "7e045841f08f6c29100c5c45e5b2cdcd4d3feff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767615, "uuid": "9162e2d7-213b-4de9-bb08-deca0b620e85", "comment": "Malware payload (Vidar)", "value": "0b70b72ec6c07fa9cf28c7b271b34c27c40528983a4852a7afddc5c9b73c453142aba206df4d970ada076601101ab77a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767615, "uuid": "87b15643-14b9-4eae-a7ab-1047307c7ab5", "value": "T16DF623E77EC9916CD0CB8E30924F474E32E2A28A4E77B51D37CB1C029631F97854A967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767615, "uuid": "01cad435-e12e-4208-a6d1-61df0d11cfef", "value": "663db01aac141130c0fe8631c0bf50ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767615, "uuid": "8a3df65e-f559-45a3-abdb-2ba8a9550a99", "value": "196608:V/7826YKQ2b33Bpp7+pX4XpBGU6uUn4E8v5GRhW60JmZNn5B75wb78uu2jIgR:V/71QRpphXp3Xcozynehj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767615, "uuid": "20dc56c9-db51-4a8d-b64e-f2d44c3b2bcc", "value": 15592960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767615, "uuid": "56d1be23-f8a8-4145-8d35-d89007f77b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767615, "uuid": "63f23588-47cb-4fcc-9c26-c50d18b98f60", "value": "Setup_x32_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83011a8-d003-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737564, "uuid": "843f0071-1649-4e3d-ba9f-0768f3c872b5", "comment": "Malware payload (Mirai)", "value": "95112c3ce35bd679d286e4a19e0cc9f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737564, "uuid": "e2532dfc-611b-4197-9d7e-1d084388b511", "comment": "Malware payload (Mirai)", "value": "923638bf14721257e77848a69c2e284613fb38806d27dece379d800463667fc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737564, "uuid": "ea41658b-cd2e-4847-828c-a86246dbcacf", "comment": "Malware payload (Mirai)", "value": "29c95dfb309c03f0fb3ad12a541167953a4386b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737564, "uuid": "856fcbe3-e298-43a6-876a-28ffd5fec95e", "comment": "Malware payload (Mirai)", "value": "41570b0348e7ff0b839729b8f798ff22a37894f5458dda226b41c61e3197393e865fffd7cd0f690aff69cc6c4db30c9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737564, "uuid": "6644b6d7-7948-486b-9527-5a8a41b42cab", "value": "T1E0F2F2A6616F4F3FC96180B3660FE42B987FB488F50667055F16F842B7D1188DA358C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737564, "uuid": "026c9e7f-086a-4760-ad35-2290a89dc85e", "value": "768:jc1k0bXc77fEyV+q9wzHpskIRYhcZBvID39U2:I1kP7zELqizHpskIRWcHAq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737564, "uuid": "f8da42b9-1178-43a8-b245-86b3f9db7ed5", "value": 36344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737564, "uuid": "8f525d3c-3001-4e4c-a9b1-50fba1c59378", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737564, "uuid": "eb55a7fa-de86-47eb-ad13-b8123170e97d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5cc8f3-d002-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737120, "uuid": "52c9e60e-7f08-4cdc-a2df-a0d90c13143a", "comment": "Malware payload (Mirai)", "value": "937452201fec749fd4c8b8476167b298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737120, "uuid": "386460e2-df5c-4fd0-ad15-93d69f0af06b", "comment": "Malware payload (Mirai)", "value": "928d1600d05adf9d05d233b5df54e48656324f41cc0273a05a8c8b66a4c33d5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737120, "uuid": "8aa124d9-4901-488d-9007-f1107615a756", "comment": "Malware payload (Mirai)", "value": "13fad98e65b11acef6e3379cc3b92d1a0778497a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737120, "uuid": "b787f8c4-a665-47dd-af3d-f4bf5b6555ff", "comment": "Malware payload (Mirai)", "value": "55949e8a2996aabaa9448992ee01109eb52bf88634a9ef47d919c6b4ffe1af129c18356dd794c9ca0489f7dbbab0afa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737120, "uuid": "286e4c62-f20f-4a6e-b0ad-054058c084f9", "value": "T1D2B3AED7F78B1490C8224AF007C75B9E2E273211CF6799E7AC1D7A395A791DB0616BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737120, "uuid": "c06ac4fe-5bf0-47bf-8576-268892a5eaed", "value": "1536:9QiWg+f86hbxSDgvJz8pCL37rq21/FlYMoVPMg5Y5/LWx:2m+f86iUmpCDH31F9oVPMg8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737120, "uuid": "c491afa7-0264-4176-b12c-229ca9da06f2", "value": 116340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737120, "uuid": "896d3a9c-de3f-414d-8c53-5f169fa04c17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737120, "uuid": "35cb3424-9832-4e9d-a436-1f1035bed9c1", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a219f7-d00d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764741727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741727, "uuid": "565c86bf-968b-4ecb-a7e9-c3b2809b695c", "comment": "Malware payload (Mirai)", "value": "f84408964f00c79786ccd9a45ad7803d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741727, "uuid": "1d1278aa-dc81-4b36-aa0c-a97756801cc2", "comment": "Malware payload (Mirai)", "value": "93f0736c69c9de35d7209aabf635642c951c63a49496e73d097944c3c682847d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741727, "uuid": "f9d82fe9-1595-4cf7-b6fd-80c3e4d9de46", "comment": "Malware payload (Mirai)", "value": "77c40444130b247df981a3f906f55d1589e266fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741727, "uuid": "5d164666-dad0-461e-9f78-b2904bb51c21", "comment": "Malware payload (Mirai)", "value": "9697792d5eda667e2f842476bb5eb0c49d856538011b35b0a6e7d65940b9b8f66e2db4bd21702fd10db8eaa759aeff2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741727, "uuid": "ecdb83c1-6b6f-4366-a213-b644cb526ee7", "value": "T196B3E7097F621EB7D82BDC370198174A24DC634761BD3B3A7938D828FD5698E4ED38A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741727, "uuid": "f94a8620-6241-42b9-8723-ba346a8d3674", "value": "1536:3QrPiXUerHlNWGPudFl/B+JVaxOL33Y+xd0SPxOQ+dhUhbYowOY1b/LEtF/K:3QLiXUeJluJ/BQeihymh0NLEtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764741727, "uuid": "78f7fdf0-5c49-4043-a0e0-cb55fc0fa2ef", "value": 107560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764741727, "uuid": "8b0f90ea-b3c0-4ca8-a814-bd3a6a3a498e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741727, "uuid": "c9feeeb4-cf8e-4986-971f-7adc9599bcc9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a43f1b-d06f-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764783922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783922, "uuid": "b483de10-f287-4672-9829-838613d06764", "comment": "Malware payload (CoinMiner)", "value": "7ff3ee45a9e02718801d15fc3b3af09f", "object_relation": "md5", "Tag": [ { "name": "65-87-7-34", "colour": "#F73211", "exportable": true, "hide_tag": false }, { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783922, "uuid": "c7f24d75-c6d5-45c0-9067-e55123b7f269", "comment": "Malware payload (CoinMiner)", "value": "94465293b5c291da3fb2cf0eb3c6d995a4735921d876736cf9abae624dc1f4be", "object_relation": "sha256", "Tag": [ { "name": "65-87-7-34", "colour": "#F73211", "exportable": true, "hide_tag": false }, { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783922, "uuid": "4478f147-9d4b-44c6-bd7e-e52e26e2c5c5", "comment": "Malware payload (CoinMiner)", "value": "85785f774a28a041f40f80ebaad82b6b7864eb23", "object_relation": "sha1", "Tag": [ { "name": "65-87-7-34", "colour": "#F73211", "exportable": true, "hide_tag": false }, { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783922, "uuid": "2cc372ea-7068-4af1-9e2e-83571ef35a80", "comment": "Malware payload (CoinMiner)", "value": "3a845cfd872867721d9f9caca8808d0277519544b7b15606400b8cd37966a7972014547b108d35630c3db965181c2826", "object_relation": "sha3-384", "Tag": [ { "name": "65-87-7-34", "colour": "#F73211", "exportable": true, "hide_tag": false }, { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783922, "uuid": "7d1e07ff-c1d4-4d5a-8066-0427639b0e0a", "value": "T161463347F2716D70F5988636D1B4274F03485B63BEF2482C8F0FA01E9A67A89C69F578", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783922, "uuid": "a4f68a7c-64e9-4d60-9a6d-8fa548f463d9", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783922, "uuid": "7959f13e-04e9-4953-b26b-89bb7e9d3eb0", "value": "98304:YLBba/zWlI3WkkIsw3n+6+NvZKuc2UxDJchtEIP8fIRRt696yTwbaksrB4kk8YiP:YVba6e3DfmxKuietFTr69TTZksr6fhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764783922, "uuid": "7e3b1172-baa5-4dad-9f75-c4ac3fc72635", "value": 5797392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764783922, "uuid": "eb1bfe2a-aeb0-41ec-8e92-12217c96f5ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783922, "uuid": "c5a3d1dc-1463-4523-8354-29f214de30c1", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be122aaa-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764782161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782161, "uuid": "bf7bdc3e-fef2-463e-a1d0-af07a5570ed1", "comment": "Malware payload", "value": "6dcaf40b879643983879b99fb30237d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782161, "uuid": "2b7319c3-de76-486a-a5e7-ab3db879625e", "comment": "Malware payload", "value": "959640d9e8a3eaec83881f993abf34c826be07701056c05c8d47ddbb0a0753c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782161, "uuid": "141ca368-ad70-4ade-9523-20090169ee79", "comment": "Malware payload", "value": "765439b9128fdf3ab7780e9a1102476688a0ac3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782161, "uuid": "f4bfaf75-37bd-4268-98f6-392cdcd904f4", "comment": "Malware payload", "value": "c9db965977efad3fcf3d94ee754d6b7f55b6850cd9335bfe85c8add425194e4fcd3cb9f277b355f2f1d46d7f56dedff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782161, "uuid": "9a84fc0a-9b3c-4961-8810-33f7e29814fc", "value": "T166C47C1173E883B6DDBB43F1D9207081C772B91AA726DBAB3694D1A60F237805D36727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782161, "uuid": "26bcf934-2ddf-45fa-8503-d0de6307d86c", "value": "16ea232736a39f84e9f62be00fdddbb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782161, "uuid": "96b1e72d-8d7a-4805-a95d-34f709fa6a2a", "value": "12288:Nc/opGLTB14ydQtieYeCs/l+QWBWqO9dY9r:NNE/l3eYeCs/l+QGAdOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764782161, "uuid": "1d27a67b-578b-444e-9321-6f23f3fa723f", "value": 555855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764782161, "uuid": "dc8cf281-b1d5-47f9-8b48-59035a634779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782161, "uuid": "cc7e80bd-97f2-4b49-82a1-986f19e32c84", "value": "MouseJiggler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f2f9ed-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764770152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770152, "uuid": "ebdd537a-a82f-44f0-9522-a14998d1be73", "comment": "Malware payload (AgentTesla)", "value": "0a24f71cbd3f52d0bc6c3f91b43754ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770152, "uuid": "7ffc6802-9a35-4d7f-9379-537b9aeceb37", "comment": "Malware payload (AgentTesla)", "value": "964f1a49f5204ea173a64cc729ba0d026555eef213d8a71eb3dd18c942512e7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770152, "uuid": "4afc93c3-ac7b-470e-baec-b69b5516ed8f", "comment": "Malware payload (AgentTesla)", "value": "23f2af19325db4c50325225901f9bf7252a281c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770152, "uuid": "ac7df37c-4385-43ef-bf5f-f8169732fb9d", "comment": "Malware payload (AgentTesla)", "value": "f92a8308583e3498593aa8ece5787d5d17a4b2635ec183f7c810c694f0d07b156522857d989114e2d9e7e99b4b7b66f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770152, "uuid": "4837b43f-bd85-4dde-b5ca-584799f655d9", "value": "T1BF95C07BB122CB6CD0CAC5B824E3D6F21D307E141AB6524616CE275F2AB3D502D5E98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770152, "uuid": "e75388e1-b13e-42ad-9a7e-73b3d0d2ab39", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770152, "uuid": "b38eeedf-f161-41c2-bb0b-060deed4b226", "value": "24576:Suf84r7YFz75ELy9vS9/aOHR+SftSstbokJMxqavDzWLyvt487diDxHp+0o:X8a7anKy1S9/aOHRnFSUod1vDSLyh7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770152, "uuid": "17c8a9cc-34f4-4e8d-b8ec-6ac4936b36ee", "value": 2032576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770152, "uuid": "52ca82be-21c2-4222-bcd9-b3cd115a68fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770152, "uuid": "e84182ef-a3c1-493b-8585-7b4d1d4f3fa7", "value": "clean.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81eaccc3-d015-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764745124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745124, "uuid": "1a33c2e4-b533-4d15-ace3-3e6a3feb1921", "comment": "Malware payload (Mirai)", "value": "1c0b36b05f0aef5fbc479767e86c85bd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745124, "uuid": "34442c42-ee56-4b78-9868-0ebb68ed0e90", "comment": "Malware payload (Mirai)", "value": "96bea289c70ea1155d29201859ea4768fb7b51bed3f5e4b38a8c248715e0461d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745124, "uuid": "30d96a22-3da3-440c-9574-2d521962c31d", "comment": "Malware payload (Mirai)", "value": "8b1da87d7afa849c80c1c78b91de6e702683e8ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745124, "uuid": "b152ee25-0ce6-4480-b980-ae58bdc72bdb", "comment": "Malware payload (Mirai)", "value": "122af53c226b2a8a547d7daf6ff9d395df99591a2fbc68c1ed94145ae4ba42735e859fdaa4ced4860bef0726042d2c14", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745124, "uuid": "ddd5eef2-1077-488f-8a79-8b85af339d97", "value": "T11D5186CF11CE9BF0DDB5599171E948046CC6F697B4C3EE42E9E864A88C4ED84B1D0E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745124, "uuid": "2e365bcd-168c-48d4-ad07-8c48bc3aa9ee", "value": "12:q0F2ZkNP4FKX0F2wkB74FKX0F2oiko4f4FKX0F2Rkt4FKX0F2QLkQ2hVD4FKX0F+:vMU+tUdEYhg7qrpFIVwnNnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745124, "uuid": "b33d4822-6789-4aaf-8cdd-bb43f7392d6e", "value": 2737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745124, "uuid": "32f3ed6f-846d-42db-97ee-bd93cec88eb7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745124, "uuid": "1edcb2a2-7441-4b68-83c8-0b4a054108c3", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8bde21-d065-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764779422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779422, "uuid": "1f750315-5b48-4aa7-8a84-68e58d769802", "comment": "Malware payload (Vidar)", "value": "34cc8fc563a5313f6be10aefd301f8a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779422, "uuid": "cb81b2d6-55da-4588-9b73-9682b740acb3", "comment": "Malware payload (Vidar)", "value": "96befa0fb8532afd7aeb21fc1b9cc5fd3c35dfeed09b783f5d70044cce30db97", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779422, "uuid": "59df29ea-906b-4cad-bbfe-6dd7f04795c3", "comment": "Malware payload (Vidar)", "value": "e78d39f2904b8f588c30a5fd946c9956acb57f52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779422, "uuid": "5e10f1ca-43f9-4ad5-b4e7-ad0695889646", "comment": "Malware payload (Vidar)", "value": "3de8a00d260ae269344c957f1da6b5132b2dfb305c2998e6240ab439671ca8127b66c0f10963e22656026a560ff9ad7c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779422, "uuid": "df51205d-f916-47d6-9db1-e1a8e6f517d4", "value": "T111362813BDA1CD68D49AE079A8715241FAB03C58DB3827C3EA4EBDB5DDBD3C4157A220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779422, "uuid": "42e9011f-f5b3-43d8-830f-82cfc92dd25c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779422, "uuid": "df73d2ab-d467-4f61-9bf2-19c37b9e1463", "value": "49152:+GnES/qRZHTiyV2TXkKaJs/UMr6PFBFJ+KiNRXWafOE4lqWX9dod3nu:+MGHM6Pj+P3sB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764779422, "uuid": "6758c963-68dd-4a25-85e1-95553a45a60b", "value": 5183704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764779422, "uuid": "a007955f-074a-462d-9a12-b3373b7a7d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779422, "uuid": "3d4852e5-6baf-4757-b780-6245fb09980a", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26e8cf4-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764770116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770116, "uuid": "cce80dc4-a69f-497d-bc96-b948449c72e6", "comment": "Malware payload (AgentTesla)", "value": "f3e3bcd0a5406db01369ef21e398bf40", "object_relation": "md5", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770116, "uuid": "6ad0f0b4-b0ec-4012-a1bc-276b79386c8c", "comment": "Malware payload (AgentTesla)", "value": "96c58e4ddb87760bdfc0067fa67e8481b4c689d943d1e2a4a518b395f7e731e6", "object_relation": "sha256", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770116, "uuid": "abbf6b95-83a7-44c0-b7de-a4a480c28a72", "comment": "Malware payload (AgentTesla)", "value": "12432084e2dee368021a7f5604787e5ecb97447e", "object_relation": "sha1", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770116, "uuid": "d4f0b25a-51c9-45c8-84c4-0c42a6d80e29", "comment": "Malware payload (AgentTesla)", "value": "df32794108f71238563eaf703b021d8107dc4ed0be37859dc9ab543fdfb5e4cee5f3ab6bf7315af29075116d7bba4b97", "object_relation": "sha3-384", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770116, "uuid": "abeacc68-bf0a-4678-8ec8-8d0eb3e46341", "value": "T13131193C1B2CA830DA24204858EBC7B571E34B2C9C6E1239B567A57330946C031FAF63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770116, "uuid": "ff9290e3-4773-4f4c-9f5b-440149c055bb", "value": "48:lHQy+o+H5B4/sEgzyFIyRriD0kvpokm5QEr0D:tQxok5B41Rry0kuv5QEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770116, "uuid": "f6489a16-b6af-47f3-837b-64befb1bd0e9", "value": 1838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770116, "uuid": "9afa7388-0024-48e4-b02f-1e50250a24b0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770116, "uuid": "d28ae824-96f4-4060-b74f-8a0e1600a850", "value": "FreeFortniteCleaner.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5bb155-d03f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763021, "uuid": "889945e4-4ca8-4aa6-8f00-2878bea0366e", "comment": "Malware payload (Mirai)", "value": "fd9d580d2403630d8c926c2460375cc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763021, "uuid": "0735080c-8abd-4f4d-9b75-0dc7b105e03a", "comment": "Malware payload (Mirai)", "value": "96d8c27c2fee1c08c73b55604d31656264f28cb545051107c657bc2832638587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763021, "uuid": "1f22d27d-be62-4f30-8b00-546d63ce37b0", "comment": "Malware payload (Mirai)", "value": "fc8b63a28f28e12e6215f0e603531e55b58f6383", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763021, "uuid": "1094f269-b042-44bc-a9a1-23767569d982", "comment": "Malware payload (Mirai)", "value": "8e7b06b2a820946c2be737377b48ad8ccbcaf77a9c699af09f7513923e0f36cab3fbe601c37ee00a92505842a7301104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763021, "uuid": "b6d38fba-ab52-4b31-9695-5755e605bb32", "value": "T19823F1AD52174CF7CF2BB2FD063623C07D318979B51B49461B279ED52E026F8E402AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763021, "uuid": "4e87ebfc-5e4a-440d-aef0-0ad0adeaa0b9", "value": "768:u6jTdhisHDFnls2LeUm9RbK3z0JgYeEDGeI2cPuVJOFqyF3UfvpqJgGlzDpUYs5y:uITrFlzBqA+dDGeI2CqjvwVqYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763021, "uuid": "504a0ff2-d3e6-4a11-8801-27d0a78709e5", "value": 46168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763021, "uuid": "0831f665-7ba6-4624-8eaf-bf85d7415fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763021, "uuid": "9675d3af-c08f-465e-9acb-7767733bcdee", "value": "SecuriteInfo.com.Linux.Siggen.9999.22757.26882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd37372-d009-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739825, "uuid": "7a97b77e-9860-43d2-a7d4-234c96c7c4e4", "comment": "Malware payload (Mirai)", "value": "a77c30767cd4f68921363dc65aeda3d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739825, "uuid": "53e1a1ac-77fd-4591-93fa-290e27cb7848", "comment": "Malware payload (Mirai)", "value": "9790c2fcd366976be57488639eeac385df6e9b7a38a3162c541514d4b43cce00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739825, "uuid": "2db00c24-cef9-42b3-b9c1-0a763e0e0cdb", "comment": "Malware payload (Mirai)", "value": "cfc0906d51448b992612f200bfa5c17b0559d3b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739825, "uuid": "9ab4fc6e-adfa-4b6c-b1dd-9de1464f1649", "comment": "Malware payload (Mirai)", "value": "7477b2efe122654455d053de33b12c120b7ce92548b115546158b25f029c614428d0d6fbabbdeba5b92176fee20efcbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739825, "uuid": "e1b50427-f9b5-4e6f-8e48-352ca7111eb8", "value": "T10904D81A9FA10FBBDC6FDE3702A90B4235CC951722A43B753678D528F54E90B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739825, "uuid": "edf93ff2-f27d-41e3-ae69-636903d190b2", "value": "1536:sil68FnhqRWdQd3du+uHhxLnHHDxN2g9LlvPZJImeTbZ3VWCSIRgohHpgvWGs1v7:s10qwy3wHzR3ZJIRHOYXovWb1um1au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739825, "uuid": "98c9558b-142c-461b-85d5-163474c40321", "value": 173604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739825, "uuid": "0ec951bc-5948-470b-96c4-86cd522cedae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739825, "uuid": "fa89a97f-7bba-4bfa-86af-5609375f3317", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec8375d-d000-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764735911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735911, "uuid": "abb485e6-23c8-4581-b45f-b0f83e6f67ee", "comment": "Malware payload (PureLogsStealer)", "value": "504839df88e961cf8b64f823c9296b19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735911, "uuid": "503693d2-9d03-4e3f-b2d3-edc444c4cf68", "comment": "Malware payload (PureLogsStealer)", "value": "97b8880dafb256c7cc158c86fda1d9e9c06d2a5a740801893cd81f28b9d1a996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735911, "uuid": "556f9733-5280-4861-8393-e979bd1997ef", "comment": "Malware payload (PureLogsStealer)", "value": "a1e760bef6c58092dc06bc4ef5ec65fb8d873ac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735911, "uuid": "ceff54b3-554d-46de-98a0-ff247ab4e97e", "comment": "Malware payload (PureLogsStealer)", "value": "70005a15668b3a36b8d93d35342a4a1194dd62a227150a617da46d92123508b32e20670972e7b87367b6dd40c548e429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735911, "uuid": "568040d8-da3f-4a6b-949c-cd78864ecd8b", "value": "T15AE41223EE61A025E2A5B431D9D37A53A0F4E9DC0454F8EB837852B14F6B73A074E58F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735911, "uuid": "0c18e3d8-3133-465f-a13d-efd3537d6d29", "value": "04180c2e0941217054f58f7e4f665469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735911, "uuid": "2c2c6c46-31e4-4aca-8fac-65f2a22bbb0f", "value": "12288:LR6R72jVG5MgP0iJ/U1s7AKWGzVESlUhb6TMHuRCZmZoor1a+cROQL3:LR6RKG5Mg80qs7AKBzOZlaCZmZow1XwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735911, "uuid": "bc9042e3-67a7-478d-8fea-06f01f724452", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735911, "uuid": "b77eaf2b-ffec-4996-9ba5-4d8fdef7685f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735911, "uuid": "8d0b01bf-bfb0-41d2-bc40-64996ee31d37", "value": "NewPayment-USDbank3033-210MLL-WQ001-XW399-COI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4be5555-d09b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764802761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802761, "uuid": "85b4e66a-6f6d-4c71-a697-aced8862d60a", "comment": "Malware payload (Mirai)", "value": "1c02a648a81296ede94fdbb8c0996ecf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802761, "uuid": "76c6fb27-ddc0-45d0-a503-f5d9f4808bd1", "comment": "Malware payload (Mirai)", "value": "97bf48e633d91ca8ec27e6b6f6361a50886eda635e99a60772a66f735d62a024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802761, "uuid": "eab79722-222d-4170-a896-9c36839432ab", "comment": "Malware payload (Mirai)", "value": "f521cc29d687a8acda2cbcfc317ba0b0134155de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764802761, "uuid": "f039e755-cda6-49a1-bc63-c40a2431ebc8", "comment": "Malware payload (Mirai)", "value": "f2f1c28c8f8ab53180b122edf376bb181a005f2abadb3f4dfdf5f0b63c47282b3c7e06580e1cb084c8eafe9598689dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802761, "uuid": "a6a31d7b-d5e3-4887-ac88-5dba65a36bd5", "value": "T101F33945FC40DB27C5C266BBFB4E438D372617A8D2EEB2139D259F213B9A55B0E3A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802761, "uuid": "82ea107d-0b95-4e4b-a1d8-09ddfae2b565", "value": "3072:Uy/2GTkHXMWAG8VNrhCSd4ThXEXYpvlV2H7Is:HHTuXMWAG8P17d4T5EXYJj2bIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764802761, "uuid": "87b1d1c0-945d-49f0-a889-32dd3d1eb469", "value": 168464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764802761, "uuid": "a12b67e7-bd7d-467b-8afd-97922154b8ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764802761, "uuid": "c14da07e-e86e-4631-8cd9-e04bbeb40943", "value": "sync.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c792adc9-d063-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764778741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778741, "uuid": "a46da6e7-bae3-4ac7-8f3a-c655e022d29e", "comment": "Malware payload (SalatStealer)", "value": "93f5b1064127c877c3cc2043f2ad8b69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778741, "uuid": "e8eec943-bf50-4120-9a3c-f910816e83a3", "comment": "Malware payload (SalatStealer)", "value": "97e4072ab5d871c2c47a6d4ab482945243d05c069e79cfc41b8dce7bbbb810c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778741, "uuid": "8f86aac1-08fa-4080-876c-0cba22dca406", "comment": "Malware payload (SalatStealer)", "value": "4d81e4ed0fb47cf353ca44ad7da7ff0a1e7a1191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778741, "uuid": "f6e32782-7c44-4962-899f-f5d7ffb93f0c", "comment": "Malware payload (SalatStealer)", "value": "2e800fc39ac4bfae49a206656e50028ffff3dcf7951c4d73f60e9af17e1d927527cb3f111948ca7a0020697ee1441c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778741, "uuid": "02ece46b-4a2a-451f-890e-80819eaefc87", "value": "T1C7E533E767352AB9D3AF2275C3C020DC223F53C152596D2E32B36E54D9D2BA47124EE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778741, "uuid": "9dc8a692-37c1-4bb0-971b-568cdea94b97", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778741, "uuid": "66dff430-d209-4a40-ace3-7e7050e94d03", "value": "49152:WxbGZ4cLHxkRclQLO2N6AnrGB2wB2pPJtVG7i5s7KKlzx:FxkIGZ6krGfSbGp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764778741, "uuid": "8214a170-317a-44a3-8f06-7e63e63cd17a", "value": 3289088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764778741, "uuid": "05ac98a8-9432-4df6-9b7a-999e58a3a892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778741, "uuid": "bde14403-87cc-4e9d-ad47-b4ecb4083305", "value": "NeverloseCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb0f795-d021-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764750192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750192, "uuid": "51c86318-5388-4f6c-af28-5a6963a2c878", "comment": "Malware payload (NetSupport)", "value": "6ee11782b2bdb1a71af219d77b960409", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jkwj238llwekdl-com", "colour": "#51A768", "exportable": true, "hide_tag": false }, { "name": "kjrkwjednjendwjedkwejdw-com", "colour": "#899981", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750192, "uuid": "f86878ea-5de5-488c-8bff-9758cf2ee925", "comment": "Malware payload (NetSupport)", "value": "997998391039c8b4726009957b06d5dafda6ca1ba3eb11710b5c13e6d148c2ad", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jkwj238llwekdl-com", "colour": "#51A768", "exportable": true, "hide_tag": false }, { "name": "kjrkwjednjendwjedkwejdw-com", "colour": "#899981", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750192, "uuid": "e1ce6c18-8999-4628-bd92-03459ea41b15", "comment": "Malware payload (NetSupport)", "value": "ce674113850b6276864360672ef7f6a26e7b256d", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jkwj238llwekdl-com", "colour": "#51A768", "exportable": true, "hide_tag": false }, { "name": "kjrkwjednjendwjedkwejdw-com", "colour": "#899981", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750192, "uuid": "ccb17cd3-98ff-4651-8d8a-882fe8bbb148", "comment": "Malware payload (NetSupport)", "value": "f1712a12ba08c19da75da41897d5e3a4cdb482b8bdbb8fee7e458c2d6ee35e62574c8e1326e3b193721f9c7979a9a9dd", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jkwj238llwekdl-com", "colour": "#51A768", "exportable": true, "hide_tag": false }, { "name": "kjrkwjednjendwjedkwejdw-com", "colour": "#899981", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750192, "uuid": "7219d3a9-1962-4438-9c49-5f539328e427", "value": "T111A2E030AB7CE666E71D0AF3B6D6684C8FFD5014168042CAE8CCED01074FB9F10161A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750192, "uuid": "c581fc5f-b925-4400-a72f-6b29561902fe", "value": "384:+XoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5NWY:+XKuqXS69Szi/urdMt5lBUeuhJrsRxLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750192, "uuid": "1dbc5df9-02a1-4c20-a95c-2344798cc007", "value": 22173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750192, "uuid": "a9fe6912-545c-4891-81d8-533940324f61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750192, "uuid": "66d43109-c637-47fe-bfa6-d4f88568798c", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a9e6cd-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764770611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770611, "uuid": "c0d898c3-5813-46fd-963f-ac15160beff4", "comment": "Malware payload (RemcosRAT)", "value": "16559a9eb01cf0873641816e2bd22a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770611, "uuid": "2b45cdf2-4d03-456a-96f9-4baf52d2dd79", "comment": "Malware payload (RemcosRAT)", "value": "999c04854a14a50e67c4efb840139402b256ae8c84582b36f1f4ab3878fd2af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770611, "uuid": "757c6e61-b894-4f65-b45f-bbc63ac957d8", "comment": "Malware payload (RemcosRAT)", "value": "4a90cc251c03e24bb9a4725897e84b20141361d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770611, "uuid": "a83b73f8-45c5-45e0-a473-14d439b6fde5", "comment": "Malware payload (RemcosRAT)", "value": "b4600dd243f96180b683b39cc14228f8458510d8760ab9bc709fdcadfbd56db2b0e8116501ffc2d3628af9e2b370055b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770611, "uuid": "d51f3445-defd-44e3-a7aa-7c6510a75100", "value": "T1B065E166A1F08436E123CAB55C1A938A642DBEB43FB59C5636DC3F6C8F356742C250B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770611, "uuid": "2966e94e-d88b-4d10-aed5-973343e20914", "value": "eb41e5567017c33839f07ebe2eb84cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770611, "uuid": "605dc3da-e507-41a1-b9c7-d3edc77fb80e", "value": "24576:bbCbz7++IfUFixpw0QB7FqyJOXkjimcrbyc55LY2rz1Ocp9WsrEJioSEn/2NHH:bbiFjbPqyJOX4imcrekRY2lIEEJ9nehH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770611, "uuid": "35b14673-c824-4ea6-b523-1e6d912f0d10", "value": 1536000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770611, "uuid": "375a6684-dfcd-464b-8726-4728fc30d92f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770611, "uuid": "543c5b2f-a413-4070-bbeb-eeded5070e0d", "value": "HSBC Bank_Payment Advice Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e24b00-d011-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743458, "uuid": "3bb24d9c-21d8-4ab1-a4c8-778b090b0283", "comment": "Malware payload (Mirai)", "value": "3f92ddaee606ddf5805eb0d2a438a714", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743458, "uuid": "3262a1d0-a57d-45ca-8b30-f6cc2ee6f19d", "comment": "Malware payload (Mirai)", "value": "99bff4adcb1e047daa826367b3fa3a69d6fe84fb4f0127f3e5c90a9388d80f62", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743458, "uuid": "7ee3a420-30ae-4991-81c9-96c309add104", "comment": "Malware payload (Mirai)", "value": "b6b7d2133e9ccdaddda28bc6a3c63ee969d132fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743458, "uuid": "553019cc-b966-4f69-afbb-d57252af2044", "comment": "Malware payload (Mirai)", "value": "05fe32319127fb506c32317875b6002fd80d51cdca2382fb4613f7f30cd5b5429dbf44e704fc37696e6bebf2167f90ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743458, "uuid": "56997e81-4e1e-4b86-a161-baf43f64e4d0", "value": "T1D95163CF15CAD7F0DDB5599171E988046CC2F697B4C3EF42E9E824A94C8ED8071D0E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743458, "uuid": "eecab9dd-98a0-4e02-b505-6abd2c92461d", "value": "12:q0F2ZkNP6FKX0F2wkB76FKX0F2oiko4f6FKX0F2Rkt6FKX0F2QLkQ2hVD6FKX0Fe:vmU0tU7eYhK7qtnDyV6ZNZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743458, "uuid": "0886e666-1191-4fc3-8dcc-7ae676b7e116", "value": 2711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743458, "uuid": "5dab1bab-6706-4bcc-bbd5-7103fcd8e9dd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743458, "uuid": "380e2f2b-0e4e-4ee5-81d7-0f242304ceea", "value": "zyxel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f130c098-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793843, "uuid": "abc92d72-17a3-428c-8482-37dad5b428c1", "comment": "Malware payload (Mirai)", "value": "e0abd74a1f129b2649dd86168e94e639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793843, "uuid": "dd0a3bab-743c-4018-be6e-2d662d1a4b36", "comment": "Malware payload (Mirai)", "value": "9a42e08dc430141663c407249fad2b1df72492c7315e108f3818d5637ff118ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793843, "uuid": "1186711d-d973-4e7e-a370-aaeebe51bbd6", "comment": "Malware payload (Mirai)", "value": "a31a3894971a0250e4116901cdd093f0408cba97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793843, "uuid": "eb7e2029-ff65-4a3c-a49a-c2cd95fd07fc", "comment": "Malware payload (Mirai)", "value": "64697bb7515c9963bea4426575737febd0422a0ba8b1e36f5fdc0366cf550f55caae9143ae0544b2e33154b8f6f2102d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793843, "uuid": "5dac83f1-ca28-4adc-b84d-8f67fbac20b6", "value": "T1AEA34A41F8929A12C6D013BBFB2E228E332663A4D2DF3207DE15AF21378659B0D77745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793843, "uuid": "9cb422bc-5e19-410e-bd62-252b923c061e", "value": "1536:mIsvP5gdAAENrRrWyYMadKweUkMPhPqMuSAgPUpi8cRxv4dh:mIAPdAAY7K4PhPqMCxa4dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793843, "uuid": "fa545b67-c939-404b-8d91-a30df79a1324", "value": 99816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793843, "uuid": "c9680f6e-feb1-4e51-993f-6b9f978c1a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793843, "uuid": "1b20d2f5-1ca0-4585-869c-4951f08c5fca", "value": "zerobotv9.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea9bf3c-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767881, "uuid": "5b8858cc-a1e4-41d5-9297-1295616b0249", "comment": "Malware payload (Mirai)", "value": "6ff9d44f697eb15d298c04778978e393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767881, "uuid": "3b2ca75a-e07f-4fca-a4b3-1f54e6412704", "comment": "Malware payload (Mirai)", "value": "9a598c801604aacb47b2cddd1ea34849174777eccafb43f0a713a61072c45aa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767881, "uuid": "52aab552-2e09-4b8f-8c81-a76a47e0bed8", "comment": "Malware payload (Mirai)", "value": "a7e6da24be5f71a1518103cd5eadc23c845ff971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767881, "uuid": "06939855-7122-4924-90e8-92715b9b7238", "comment": "Malware payload (Mirai)", "value": "9ac749a1e41c9c3ff097daf0943ecc17fb438bd880b2e69c0adc57ffb5f348d3f8134b54b08916be4e442f6c73cde01b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767881, "uuid": "740336cb-0b94-4d2e-84b2-dcde508708c5", "value": "T16D23F1D0F581BEF0D7729B3EDDB581A3E0E02E54947838B66539026DDBED588906CC63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767881, "uuid": "3a087365-58ca-4406-b309-73cda1ede755", "value": "768:1IUP5C6C9ANahcumveeiRRnXcFD/l3jI1DzXhSUfX0APrlagQb4DLJ58+E8q3UIK:fPchhW6nsxN3jIFjjPzPrQivJ5YzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767881, "uuid": "4a1a0b51-5e8b-4747-a796-7b72a18f9900", "value": 48700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767881, "uuid": "71d1d04b-cc09-4631-9abd-0d97319bdd80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767881, "uuid": "51db262e-d099-455c-bf1b-4bbded8de209", "value": "SecuriteInfo.com.Linux.Siggen.9999.2326.21323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe1fd0f-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764782184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782184, "uuid": "aad21c75-6b59-40c3-b97a-df6d2c156f1d", "comment": "Malware payload", "value": "cd86fb5cfe6a1c4e23c66ae31cd3ed19", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782184, "uuid": "53565a9d-cee9-4e32-a1a4-ad8f32a1b3e7", "comment": "Malware payload", "value": "9b13974c79f4a82b0503d09be90b48c38a1fd1b1a41528e98f6375a30aaa9ff5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782184, "uuid": "852a6431-bda7-4354-8bb6-98aa2690ef3f", "comment": "Malware payload", "value": "96e136c71bf159a2d465028f37fb795993692b1a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782184, "uuid": "e21f6bb1-5f48-4e95-a8b4-e0e006e58d12", "comment": "Malware payload", "value": "5306377cef493d2851f34eb7b030d2562377e5d655e790eb8b8c95c0828c05abbd19d60db669da9a94cc27111a849837", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782184, "uuid": "86ad3963-910e-47b8-8092-c74fbb2514bc", "value": "T14F46F1C7F7D8A92FC877507289BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782184, "uuid": "4cdf7f8b-efd0-4fbb-a067-e7109aaf4c4a", "value": "98304:EPmoTwrY5Kjofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltT:ENKMfyaIbaciAFvrEZpXqmY9XrF/mpCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764782184, "uuid": "42af1d2c-2ec5-4d49-b85b-dd8b7668a8c6", "value": 5833322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764782184, "uuid": "7fbeb9bb-9122-40ef-b477-93feaa11c082", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782184, "uuid": "41137e56-1c73-4f8d-971d-3c652fed6521", "value": "masuraplay77.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821b72b8-d07d-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764789792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789792, "uuid": "1bae8770-601d-49ef-8c82-c8b8fa29f3e8", "comment": "Malware payload (ACRStealer)", "value": "609c978a1540cd48e0e3fc32f945d885", "object_relation": "md5", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789792, "uuid": "12512742-6db7-4868-b09e-e50e31369121", "comment": "Malware payload (ACRStealer)", "value": "9bacbf1afe9b37916daba0efb091dfee5438bfd19d3edb0b5de29b73484037b3", "object_relation": "sha256", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789792, "uuid": "afbe3ecd-dc82-4410-98a4-daf5b1b1437a", "comment": "Malware payload (ACRStealer)", "value": "066dbc9bd4e76b6b4a559604f71c61c4583570b8", "object_relation": "sha1", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789792, "uuid": "f17abe5e-c7db-4b67-a30d-c4d17cf2395c", "comment": "Malware payload (ACRStealer)", "value": "7c1a4c6234b3649f40667c93caa9df0a13317192229a01b069f52e50174bda0234f4a15f758441ec55ded2c6d7e3e119", "object_relation": "sha3-384", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789792, "uuid": "99308dc0-3ab5-47ad-afa3-bdc14cd470a8", "value": "T14077233A6AAC69C0FB1B45F1C1769A8C50F165022296FDBD3F2426158D9FBC0E732787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789792, "uuid": "48fdee69-c2b5-486c-8dcc-ceb70259b3b9", "value": "786432:qi7kNHUim850CVGXP65XhQOsYseq7Vo4CJQ5SmPse4ca:boN0n8iYLQ7Y6i4qiSaYca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789792, "uuid": "f0350685-b8ce-4343-a68f-71953a089dfc", "value": 35731857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789792, "uuid": "91d7ea9d-24b2-4134-94e7-8d776c0a569b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789792, "uuid": "348936da-6445-43fe-b1bc-8d93a01b6dba", "value": "Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df54d306-d071-11f0-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1764784794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784794, "uuid": "c078360d-7908-43db-a4cb-a8870e13b2ec", "comment": "Malware payload (XoriumStealer)", "value": "575a35e4a8dda21a712c57a2ea30b68f", "object_relation": "md5", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784794, "uuid": "082db284-a8b6-48a3-b6f9-889bdbcfcdb7", "comment": "Malware payload (XoriumStealer)", "value": "9bb808a0df59a1f9c5b73795505051ef32cc8abfb74dbef0fca21afc6b5ce4f8", "object_relation": "sha256", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784794, "uuid": "d059a6b6-5525-43f5-bb42-a891d7265973", "comment": "Malware payload (XoriumStealer)", "value": "3f6d819732fb094d2d1ce6f752692c8287b76d58", "object_relation": "sha1", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784794, "uuid": "97e566a8-985c-460d-96e6-10b94aa69317", "comment": "Malware payload (XoriumStealer)", "value": "5e90071739be3fc6e184da98b62a1b3ec17ab1b10041a17b7495d4c516ca4ebcef3b140a6a336059a73eb7b52cd79189", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784794, "uuid": "bf0f12ac-7a82-4f42-abeb-da6882f49f83", "value": "T195967DE722C2BACEC126D0BEC752F97F494FB43A4916F2A39065B266DE23C107554F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784794, "uuid": "d21393d1-289e-4f07-8e50-ed2ac414788b", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784794, "uuid": "f8523242-f133-497d-9de4-f0bc46f84e9f", "value": "196608:C1sKROCRx11eq9s0dYs/Z6znwnYdOZePwM:VKRDZXhmsBu0YI2wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784794, "uuid": "6c226c5e-b171-46b8-84b4-5935d27dd5ad", "value": 8821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784794, "uuid": "e192ef83-c1f1-49fc-a3bd-e7ac716ed6bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784794, "uuid": "83da0405-339d-4c58-8325-d0c5250931ea", "value": "9bb808a0df59a1f9c5b73795505051ef32cc8abfb74dbef0fca21afc6b5ce4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71feb33e-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746815, "uuid": "661ebd14-f92c-450b-b8d6-8ee0bf9714cd", "comment": "Malware payload (Mirai)", "value": "8992877fb4e7426f3910df066772a3ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746815, "uuid": "b4ba05a1-76db-4ff1-a2dd-ab53250c7522", "comment": "Malware payload (Mirai)", "value": "9c05f063af0c3b63e7bd4b990303914a24722d6ec637aaf282faf050b9ae4166", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746815, "uuid": "a2348b65-a06e-4634-899d-3bee3d37baf4", "comment": "Malware payload (Mirai)", "value": "7f9843699bce17fb3f02ad56b3f0be12c826f52e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746815, "uuid": "2e8ba9c2-8de5-426a-aa0c-16324227ff40", "comment": "Malware payload (Mirai)", "value": "2965929188f1e9e4bb2582c8a3dfbd699a784a590fce4212349f6a42d37dfbe8ff67b31b8a3c0a4af328d815c4c49ffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746815, "uuid": "ee423d2c-d437-4896-9d71-96154efa978f", "value": "T130D35D87F4019E3DF85AD67A81370A0DF421A25466A20B27F367BC9BBC730A45F1EE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746815, "uuid": "8592f2e6-164f-423b-ae3f-5f9baeb3d6a5", "value": "3072:AG5LuddsqFfo4f5bMYb0JP1HjgxTr7t3gwd9RY:VLuddsqFg4dMYq1sr7tzdLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746815, "uuid": "ca97d24c-35df-4556-b9bd-69e36a732ad0", "value": 131648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746815, "uuid": "6f9a7acf-0c4a-41e4-a540-71c9423b6041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746815, "uuid": "2eb9398f-9a61-421a-83e7-2b87fa210f58", "value": "Yboats.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98a585c-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749485, "uuid": "58b5ba5d-2bc2-4941-8046-6a736be16a64", "comment": "Malware payload", "value": "7c43e2293e1aa0824001251055e6cfad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749485, "uuid": "1a4daf33-899e-486a-b264-35ce2f60f700", "comment": "Malware payload", "value": "9c4f7390cf05d88f7dffeae83d33c0a18d8c25e4f07d6c0c24f90f1fde4afc3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749485, "uuid": "aa0f1499-bc9a-4ef4-b345-b5a7eb14d486", "comment": "Malware payload", "value": "6e8bcbc608b0e25e343d15ce7ae1d4e462ec3ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749485, "uuid": "7733a9b0-52bc-41ac-9851-2d48f89b68e0", "comment": "Malware payload", "value": "6293301750b74c96e7685e844bde4f0c464312f4c519ec074151423bd9295503f5551fb268903dfe9df5f065b5850b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749485, "uuid": "7c7f0ccc-359c-44b6-9088-e2724437d680", "value": "T1C9B5CF42F361C1D9C22299BCC9A3E3A7D3723C644B2142DB37DC5A5DAF976E05E36680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749485, "uuid": "dca1f602-afda-48f1-b4ac-4071266310f3", "value": "86a37d8dd1c6fe4a60e30cdc359c7bda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749485, "uuid": "2f632c25-bc25-4d29-9b9f-90160b830925", "value": "49152:T0pCYf+KjfhffduT+rA6EQMynqZOUkN5fME:LO+uhk7vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749485, "uuid": "baaa7dbb-fc72-4423-97ac-6c60774954e0", "value": 2351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749485, "uuid": "14a8b88a-e295-4147-ac1f-55fff4fbe307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749485, "uuid": "4e9b35c3-1c07-4858-ad12-ebc9a932e561", "value": "Zeva - CS2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d127e7-d07a-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764788288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788288, "uuid": "ed1f8af3-7b04-42f2-8484-e50dcdd75e50", "comment": "Malware payload (ValleyRAT)", "value": "296cbd3f60d8c6e101607475f73e00e2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788288, "uuid": "209af347-3529-4fe0-9fd1-3561802b6f7f", "comment": "Malware payload (ValleyRAT)", "value": "9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788288, "uuid": "e1252c0d-ba0e-47be-8961-9a21e3f47fb9", "comment": "Malware payload (ValleyRAT)", "value": "b2950afc05a020966a03aaee2651c612338db5d4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788288, "uuid": "09968d4f-8a06-4e90-b363-e01e2aefde6f", "comment": "Malware payload (ValleyRAT)", "value": "3a75e5e2031b774e13d3f167efd5d870575ddfe146ee2b2f59d280e1277396909d3a68487610076f6f191053f18e01fe", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788288, "uuid": "b6c10bba-8132-4b01-bcee-8146d1a1b890", "value": "T164B5AE217387C436D56D01B3A92EFE1A643DAD7B0B3001D7B7E8795E29704C1A27EB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788288, "uuid": "78ec4614-88ab-4186-92db-f82bbf048989", "value": "49152:2jZw+TEanLBm/usqOVX7GpnADREFClUDxuj45G17fKFUs6KBOK:oyXwlFC2YbgUs5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788288, "uuid": "6a3956cc-a951-4514-bbae-b13a347006dc", "value": 2470400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788288, "uuid": "75400ed4-266d-4e1d-b54f-e6192cd39a99", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788288, "uuid": "55d5f039-5707-45fd-9ca9-4c311cd112e3", "value": "wwwstf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ff7254-d063-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764778732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778732, "uuid": "4fc885c7-4068-4e35-a65d-b675fc3b5ad6", "comment": "Malware payload", "value": "89794ad7cb12a0b5abaab33b61c072ac", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778732, "uuid": "c8c4a8fa-c5f6-4f11-b245-b4be7510f4d8", "comment": "Malware payload", "value": "9d0a11a0b7c0680d1f421001d195e28358384c6cb3a9b6e1902ef7160f023720", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778732, "uuid": "196510aa-d76b-4846-ab81-9f205c4e9b9d", "comment": "Malware payload", "value": "431178c78955a9cc2f78877f04963d90e110ed18", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778732, "uuid": "3fcec71d-9e49-4635-b591-734590bd16bc", "comment": "Malware payload", "value": "042057c3a830380395c532bb9693d1d74bfd92bacf96fed42c8499047cf4083d0651969d8c974ba4c39c61f9c2359860", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778732, "uuid": "160f5ca7-bcab-48cf-8b5a-ac70cce726b4", "value": "T123732F0849DB40F89963B8988ADF8D03F7E1851B161CD9DABB5EE6A03F1143DD1F86E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778732, "uuid": "d68d2dcd-52b7-4a2f-9594-cf0ce297eff0", "value": "768:ZJGd8RzDlbY02ZNMFJvqlt4vL5+D8AshRydCN1fZCQtpMxNyMuB34rhM7bYnl1rw:ZJiZrtUi8AMECNBt6iGZuqPOTOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764778732, "uuid": "794940af-82cf-4713-b6b1-85c4b14a05d1", "value": 76189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764778732, "uuid": "ae931cf4-6215-4fd8-bb57-152008ca0a81", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778732, "uuid": "c8bf1c34-6ee9-4962-9e4f-d8fef5eb9e78", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5352140a-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767379, "uuid": "d9e3e2c7-de90-4738-a8c2-f5f75cb66afc", "comment": "Malware payload (Mirai)", "value": "fd82ba92809e805206ae8d9b41ae1d63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767379, "uuid": "6bcf3429-e8f9-47cd-acb8-425549d7acff", "comment": "Malware payload (Mirai)", "value": "9d66b1b6ee1210514ac198a39e5d162bca1d3343ab4971a404e18b72ad0e453d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767379, "uuid": "02a6d239-e373-4a66-b592-eb3f26885b7e", "comment": "Malware payload (Mirai)", "value": "9fa757a39e44e6a926cbfa0dc04cb46b2e7bcc75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767379, "uuid": "981a5425-6993-45b5-bd9c-142b534cd8b3", "comment": "Malware payload (Mirai)", "value": "d992cd0936f01f3756dd0b255b00f90e3c99a1dcbb083a337d17495f3eb043d75be3cd83ebf1ac2bb22f2634577d0e10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767379, "uuid": "0d7f2eb4-84bb-4c34-8abf-855cedf5aa73", "value": "T12C93D506BB650FFBD86FCD3746A9071239CC550A22E93B3A3674C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767379, "uuid": "7e145c0c-0e62-4599-9c76-4487659c6336", "value": "1536:lX1tMe0R/thi4BZEvPgaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//REp5Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767379, "uuid": "4747f104-a873-4e64-8914-cacd9629a88b", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767379, "uuid": "b014ebe7-7b92-4c46-a0d8-b9dc7758dca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767379, "uuid": "2611c3a4-21eb-4997-abe2-8cb4eb15aa20", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832d0b59-d082-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764791941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791941, "uuid": "f05e7817-fd8d-404d-8501-6ec2af0ef91d", "comment": "Malware payload (Mirai)", "value": "ff0d5133cd2fe222c95712009c3bdda9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791941, "uuid": "6a8b4ef9-e87e-4592-94e5-9103d851a1d5", "comment": "Malware payload (Mirai)", "value": "9d91a175a629aa31f4ff6289dc2fdb60b13b859ed819f578731107caab26583f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791941, "uuid": "1c1859c7-6a65-41eb-8b75-3c93c1adfee3", "comment": "Malware payload (Mirai)", "value": "78b15d7ab2795de63dbd52bc1eae44e48ce76251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791941, "uuid": "d9b39696-b12b-4d66-a31d-fa6a5fc0cc8a", "comment": "Malware payload (Mirai)", "value": "a98171b9582e787afa912f4b2db84afbf36d026253e464cfc8d9826a8ad7751c73921a2cf3287f9e0a297bf420c53ff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791941, "uuid": "b11a1c8e-d120-438e-9d79-fcfe2c4de7f2", "value": "T1B66302186B57EAD0DD3065388DE50784AF12E7B85AD634A32390CD18E6D67136FFAC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791941, "uuid": "7e784be8-7426-49ba-8965-0abceb5517f7", "value": "1536:j4YeCK8lpEyEBafotAe1wZMsXLSsVC11BuDv:jzeCK8HlfyAeHwLkUDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764791941, "uuid": "4df4376f-f9a3-4305-9c74-1444c5fd4ca9", "value": 68800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764791941, "uuid": "4ce30342-2487-450d-84d5-9c5794f82796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791941, "uuid": "439568b2-d5d2-4533-8d5c-d345569cde25", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42213052-d056-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764772934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772934, "uuid": "33f9c3db-39af-4b8e-b0b6-843e603c34ad", "comment": "Malware payload (Stealc)", "value": "f1fe16e5378226845c5c2e230666de75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772934, "uuid": "b90f48d0-ab5e-4e85-a3f9-9c8789cb9ab3", "comment": "Malware payload (Stealc)", "value": "9dd1001e76c345b016c5727650d26cecbaed304ed0960eff4fcaaa60a8d3bc86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772934, "uuid": "e09d89b7-a19c-4ea5-8699-4720710cf8e5", "comment": "Malware payload (Stealc)", "value": "fbbac0a892e8d46f4c91290700f9c53ea933d1de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772934, "uuid": "1354d6a0-5f5b-4134-957a-b0d29423480e", "comment": "Malware payload (Stealc)", "value": "799ce0a65741566a533798f1826fc1acd48a10fe624135a4dd3de366428fc30f953221e3f47e1794f611708577a38d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772934, "uuid": "4728b844-69ec-4a42-bdfc-c6cac9809b65", "value": "T174067B66BE4039E2D06BEA32C96365952F613C195B3237C71D9072AD1E733D1AE3DE08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772934, "uuid": "e5aca5d3-4f0d-43d3-a566-fa5fdeb177e3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772934, "uuid": "316bc7bb-c5a1-469c-9b0a-debd5940e2c6", "value": "24576:VM6jF/zLlO9gUOejmFNTeY4Ga7FdkPNtDmPcQQ8xCZsopaQKMj7KVDETN2vufKAm:VMspvlkglVFBe5GeFmLUdEKtIo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772934, "uuid": "e2ceaeeb-75bd-4832-b6ac-dccff76e35f9", "value": 3989504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772934, "uuid": "3a41e138-9e9c-4afa-8770-fa14dbc244a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772934, "uuid": "d8dc9257-5b55-4ef5-bb34-957829e5a62e", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ee46a3-d055-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764772491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772491, "uuid": "4d290013-c37a-4e89-be79-21ce37939a19", "comment": "Malware payload", "value": "1a90031c403e157290a20cc723c1f95b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772491, "uuid": "02d4b993-9bca-4738-bb24-a864115ae3f5", "comment": "Malware payload", "value": "9e246fa232a49a29df6a55267291cb815da5546c1d4005e13ef363a1bcb86269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772491, "uuid": "62b6f718-c2c1-4270-ad91-34d1884e0cde", "comment": "Malware payload", "value": "4bcf941552a500b29c3b0731008391a127f36743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772491, "uuid": "56dd0402-b043-455f-920b-10fdcd876e93", "comment": "Malware payload", "value": "10f90d4e9871e4bc654c71cd890d46682272c17b853f1f434d486606bffbed7609e78760df59a62d1afde75c5cf5f825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772491, "uuid": "524652fd-39b9-4e8a-9215-d16615cf0d70", "value": "T10D553A9F93D5E0D6C3394075C15A830BA669B239273546EB427BC4191F363B92E3FB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772491, "uuid": "7b75677b-dde4-4230-9b97-2b640d8517e6", "value": "36b13ef9e49c4022788ddeda587969ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772491, "uuid": "8e16cbfd-a6e1-47eb-91cc-398d01cea5d6", "value": "24576:dVU5sRKyUS5upCpRyYc80hW/qO8JC+wNBPoOZwVD0nt5:topCu9fhWDYEyOqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772491, "uuid": "ee099069-30ee-45e5-8108-80f0cacae3d4", "value": 1285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772491, "uuid": "7f964bab-476d-4787-ae47-1ab8db2db00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772491, "uuid": "df4464db-041d-41e6-b1b5-0b06536153ea", "value": "1a90031c403e157290a20cc723c1f95b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e405a239-d041-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764764186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764186, "uuid": "5b6a1899-5cb9-42fc-8f83-defc68de70f1", "comment": "Malware payload (Mirai)", "value": "06e12fc8778587d696671c3984068d8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764186, "uuid": "f27fcd84-2bbb-4dcd-9c1c-16542cd2d690", "comment": "Malware payload (Mirai)", "value": "9e5161c87467747f187a6a2187bfced7c879ce172f86b4a8e6fb601e2b239b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764186, "uuid": "d4f2b7cd-f837-4557-ba29-8fb2a5bd821c", "comment": "Malware payload (Mirai)", "value": "d83a26e122844bb0cc6131a21292fa8eb144619e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764186, "uuid": "33e28aa3-48be-445a-9d10-7a6f4de0a970", "comment": "Malware payload (Mirai)", "value": "c623aa16d66ea16b82e8c565667600629d119b35d1d2cc3e7b0df96b6631b5c21564f6acc86fb3dda32d5f7887572abe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764186, "uuid": "0666e783-7f8b-40e7-9fd7-64297fe57705", "value": "T12213F1A25E558551C4F02CB7D1A48B83390844AEA0A5B67FFAB217FD90CD24239F673F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764186, "uuid": "ab41f07b-8f41-4c32-9a86-89ce83f49cf3", "value": "768:lSKtZBpTX85554DS1w55hxR54PuOBdSiWoV9xtAr8z5s5LDc7LPTTdfDbb3UL:IKt3pTX855FkpRWLjFXtArYADQLbNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764186, "uuid": "515cc5dd-cd39-45ad-bb3c-b82b5618ebfe", "value": 44336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764186, "uuid": "0173a86f-3cd1-46aa-9c59-e967262abd58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764186, "uuid": "c1338104-08cc-4300-af09-13667c5af280", "value": "Yboats.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a66ed2-d000-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735978, "uuid": "3de51b45-6c47-4b72-9511-368007bfa4f5", "comment": "Malware payload (Mirai)", "value": "f1530b72153beae060bae1b4b37e21af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735978, "uuid": "6b655ffd-b2bb-4b8b-820c-3086842167aa", "comment": "Malware payload (Mirai)", "value": "9e54555402993ac3f1b8cd9f767847d88129aea3e067e94bcaf341193591aecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735978, "uuid": "b7afa53b-3ee8-4677-8462-be533300dfea", "comment": "Malware payload (Mirai)", "value": "dbdc923cf0a44550b24b931742c93abbecaf49ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735978, "uuid": "c64dfda0-468d-4aa0-b14f-cd447859548d", "comment": "Malware payload (Mirai)", "value": "513310572e1002267b4838aa2d01db9b8949dd8d799781cdfebfccd49b95b5f3c9f4e55bc31486aa61193f6cc48bca2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735978, "uuid": "20d55274-0125-41dd-a77f-b2289b1fe626", "value": "T1DB03F1E0D70B4D2FC0A011B2255B2D1A64D246A3CCDFCAA1B7D5ACD13B78EA5D06CEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735978, "uuid": "1dd27811-2dd3-469b-bd45-ef0b52ba9844", "value": "768:hpVo+m2krgvKfMq8B3vzFgVYGaX8vjj3PoIweGSB+ss5:DVoWkydvB/JgVKgjfZdGyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735978, "uuid": "a57a3b3c-875c-4b0e-a483-571636890f41", "value": 38180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735978, "uuid": "3c5d6472-d268-4e99-8cca-ea36880dbf68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735978, "uuid": "a9daa686-be91-4deb-a14b-0aa6620ada33", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d31311-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793856, "uuid": "0722d9b1-1ba2-43c8-a570-11c0dfeeee72", "comment": "Malware payload (Mirai)", "value": "e35924666626600b27ddde2895fc56d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793856, "uuid": "76ab6df3-4507-4948-a840-0ed24505d8f1", "comment": "Malware payload (Mirai)", "value": "9f64ea43d9ba0bed705b94251dfbcdc596fc594df8c0d94c512e4573c55b30e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793856, "uuid": "c663d20f-8f8d-44f7-99ec-97da2a73ac4f", "comment": "Malware payload (Mirai)", "value": "71b8810fc29aa378d66857d3ccfd0462a6bc0c0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793856, "uuid": "e18b7795-05a3-428d-b388-a1f17ec28e49", "comment": "Malware payload (Mirai)", "value": "100a5f3fd6116ebca266f82117090acacafc518c407c490104d9add210be3bcf6005742349f871621d1e2259e735a48d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793856, "uuid": "3a429195-c262-413d-b52d-bbd787badaa5", "value": "T11D044C46EA818A13C4D717B9B69F514633239764D3DB33069A2CAFB43F827DE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793856, "uuid": "e0985f27-7331-434e-aeba-6284b5c9abbc", "value": "3072:FlLScY7eDNao18rR2AvQbtL5xCIkig4A032w9M/97Gem0U:FleqNao18rR2iQhfCXi9A032qM/97Gew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793856, "uuid": "768e0036-c237-459b-b051-e3fcd3c83357", "value": 184902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793856, "uuid": "e753bf87-b0ae-4769-96ef-d3cf5863ec07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793856, "uuid": "67effb98-7cb0-4527-b2a3-586e4bc47303", "value": "zerobotv9.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fb8d99-d013-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764744164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744164, "uuid": "42443ec7-2dbc-41a1-87d4-59bde7ba9ff6", "comment": "Malware payload (Mirai)", "value": "960ade5fc4d219cb431c845131ea317f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744164, "uuid": "46ca5fc5-4686-4ccd-9a61-3c3c03233355", "comment": "Malware payload (Mirai)", "value": "9ffeec11e4a016ebed3a3f2303c5f2174b63f3e6d96e76be64ada6fa1e93a87c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744164, "uuid": "c3a6b356-da89-4220-8ab2-c3c6defa0425", "comment": "Malware payload (Mirai)", "value": "6f97b87d9edd75b172940ca4d8ce2fa49473eb77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744164, "uuid": "10f3a242-8fab-48a3-9437-065c7a8ea1d1", "comment": "Malware payload (Mirai)", "value": "31e4a230fddc726e52658c3079fac33713edfccaf3dd827d9944960c9dd690eadaa9e70e5655fcdf263166b846ef1ca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744164, "uuid": "111ddb47-32f5-4e54-9212-472529ed34e1", "value": "T1FCB3AE31C8155DA8C1D64074A4F59F365B23E1C452A32EF70AE98AB78487FD4B909FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744164, "uuid": "058f1a03-b8d1-4d54-bf51-fef7c9a92fa5", "value": "1536:G/zbSs+eYUMoHurlEf2gNGcLYLxJq9+46K6RJr5wB2LICebcof:Gbbhd2rlusLx94d6iB2LICo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764744164, "uuid": "559367bc-1609-46da-8430-bc6c810af93b", "value": 108260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764744164, "uuid": "8975392c-5288-405c-83ae-689a9b19524e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744164, "uuid": "284aef2f-c4e1-45d9-b9df-f8f3e816089e", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1504a547-d039-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764760403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760403, "uuid": "44732dd5-5600-4ade-bbe6-8e174e05c34c", "comment": "Malware payload", "value": "ae537ff51ed8d7b06da1b097cae93824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760403, "uuid": "d2e73df7-d0a9-4fa7-af22-8bed97070ee5", "comment": "Malware payload", "value": "a03a004df6b5133d402a18b0e265b835ce937caf5d5d47de32493189c573463f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760403, "uuid": "4f20928c-5119-4dcd-9bc2-cc9449c6c242", "comment": "Malware payload", "value": "c90e7f2a37da471b89bb09bc16e28d75acbb10ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760403, "uuid": "a27f75d4-72ca-45aa-a138-0efe0aa6fc76", "comment": "Malware payload", "value": "90dd840ceadd8894e00a4e7ea902467d2aae00bf27d0729afa1addf081b69c6bdc8874aae08c255e26a81bdb49d783a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760403, "uuid": "894196cc-c8c7-4576-ae4b-2658be2c5b3a", "value": "T1A983197CA7038F31C7CDD6B582A7E52223705BA35523772E5F8490952FA2EBA49813D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760403, "uuid": "a8e8fc3f-7d82-4bff-a007-7c06306bae7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760403, "uuid": "50de71eb-bef9-4cdf-bba4-b4e95ed53c02", "value": "1536:3jB5vj+kpHo9RA7N0Xn5G5j6Dpk6FAN/T26063KsCbbiNu14bSlV3U/:TfdIDEN0Xk5uVyt/CbbioASzE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764760403, "uuid": "b46aa8e1-ce56-4478-919f-ef42e4f887e5", "value": 86048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764760403, "uuid": "0920e471-93d2-4e0e-966e-cb6b2b9d040a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760403, "uuid": "0b6749b3-7a70-47b0-a32b-9189932a6dae", "value": "a03a004df6b5133d402a18b0e265b835ce937caf5d5d47de32493189c573463f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b1461c-d06e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764783281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783281, "uuid": "de9e0929-46de-494d-86aa-2ff7dd5efd4b", "comment": "Malware payload", "value": "8832c75490913f32468b65d2e47362a9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783281, "uuid": "ec19c217-691f-4a9e-926f-83cf51b02c35", "comment": "Malware payload", "value": "a051e0daf341b5e642df9725b5da2bb1e15748d69261471866dd852b503ea475", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783281, "uuid": "d03325d9-2376-43df-8d82-1d0cd2f36472", "comment": "Malware payload", "value": "a84fb93833dcff88fd607ec386fc6cf551562dbb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783281, "uuid": "5f7fc3d9-f648-4886-8d4e-ee7ed295ee5f", "comment": "Malware payload", "value": "8d12711f1a9862da8b4abd968fe4048c6c96f00a89b1fbeecc8695aa6abd09426726ffe8af8c7f3156ce68227970f911", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783281, "uuid": "6be39d63-c018-49ee-bbb4-2b62ec8a2ca7", "value": "T1A171202372509A3813A8D3B868616214372752DB40571DEDF0FA64B42F153E5D3FEAAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783281, "uuid": "a103ee38-6e9d-4ddb-82ff-7c185a64b674", "value": "96:iaafGaBseoKjsqLKnxx/sBt5Qka5y38kwtmb/O8jQRKYcg+499/M:lafGaB1Gdnxx/o59aI3zP0L9/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764783281, "uuid": "d05e5e3f-630d-4091-b12c-1b5216cbc1df", "value": 3747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764783281, "uuid": "82301924-5ac1-41ee-8b33-5387a9249979", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783281, "uuid": "b5b28d61-fc74-4b2a-ba9e-ca1e6a252089", "value": "lmfao.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326a9616-d007-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764738977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738977, "uuid": "19cba0a9-ed2d-4358-a32f-e4cbc23a94e8", "comment": "Malware payload (Mirai)", "value": "1fcabcbea7be34b4c9c2a59c97486b62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738977, "uuid": "5b6a5dc2-19a9-4efd-88d1-8b35f4fafb11", "comment": "Malware payload (Mirai)", "value": "a14b13e991cdf765b965a04ff687125690557b971a1a092d8078090efb3d18be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738977, "uuid": "93d4a7e6-270e-4c4a-9240-c9d02ef8b0cf", "comment": "Malware payload (Mirai)", "value": "da88eb6524531a8fefbd022094c36ef68cad5120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738977, "uuid": "c2eb8f39-12cd-4302-9146-3134fe890318", "comment": "Malware payload (Mirai)", "value": "32385cbdb119328fd8af0ec717ed18a07d8f65e516dde00c5cc50f1ea5471ffcdfcdb0e35797faaa885f57d7067b84f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738977, "uuid": "fdc96716-ab28-4749-a67e-8d9f2fa614ed", "value": "T13CA3022B0D6F3956F60AB7F9414E2701F3C7599FA1A2CBF5A780222B4FD63803515B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738977, "uuid": "6d256df3-8097-4853-b75c-6fb2be36908e", "value": "3072:tqYu/3wcuzb3hH0SA6DFSIJH/CL2VEU0aO7:UR3wvzjhxzzfC3Dh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764738977, "uuid": "67a42906-4ae9-4598-8155-2cf4382d1c7b", "value": 98720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764738977, "uuid": "a383e5b8-2882-4331-ad62-af705c84218a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738977, "uuid": "50ec94ec-a8cf-4dac-b119-442f50702963", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dc22dd-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767357, "uuid": "9ebf7c96-1140-4210-85af-f8a4fe6a9867", "comment": "Malware payload (Mirai)", "value": "b24783cb39228767c1c220dd91180c08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767357, "uuid": "1d5d5274-cd7a-496f-bc60-1445c93bb40b", "comment": "Malware payload (Mirai)", "value": "a2175690fa05ee928644c3658517d92530024d44df7f76c09928fd8af5c39325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767357, "uuid": "dd17def3-e705-45e6-9adb-11322976ae35", "comment": "Malware payload (Mirai)", "value": "32a00923eda0684418b944a82a63ae986ccf7042", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767357, "uuid": "fedc2748-b397-40e0-b7f4-e4ee4c26261c", "comment": "Malware payload (Mirai)", "value": "4d6afb09010ed85b485d75a0bac8a1d66ebe33819fa022cedb4d310160bab626d1ca04e96281d668fdf014b096fee9b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767357, "uuid": "76957e7b-779a-4d53-a3ea-7e53548258f2", "value": "T1FD82C024128B7AB2E7F00435DBBA439A735947FDC0B93361161152BCCDA11AEA2F13C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767357, "uuid": "4e4a4969-c170-4456-82a6-4784eabf07c3", "value": "384:3czJ2ycgX2VF8l4sdV4dRE/Bxp9V9aq7wLN9ivhymdGUop5h4y:Md2TgGVF8lEda9VUq+zYs3Uozh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767357, "uuid": "79e79a77-d9a8-4853-8b8f-5e3be546a3d0", "value": 18032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767357, "uuid": "a4f7237e-bfe0-4d55-8717-0dafaaf59bd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767357, "uuid": "2841fb0d-94b0-4979-9271-5e36c6eecdbc", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe759323-d012-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764744044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744044, "uuid": "c29b078a-b833-4466-b044-9452b667c628", "comment": "Malware payload (Mirai)", "value": "8b536c16a61bec213cafbf2f213109f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744044, "uuid": "cdb303ad-84b4-4a11-9743-52866e08add2", "comment": "Malware payload (Mirai)", "value": "a3005d10769180a41e94d35cd0843699b072765b9bd50fb6d3bd64665520a5d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744044, "uuid": "8fa2ad3f-5712-4ff3-bc79-2b2e952ee130", "comment": "Malware payload (Mirai)", "value": "73e4064dc9a7f81c6b0efe1e15e0093237f538b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744044, "uuid": "89582f48-899a-48f9-b480-f567c306aa0d", "comment": "Malware payload (Mirai)", "value": "eda0746d72b6d46568fc3c40cb84a797cc7c1a4814198929a71358fb04e20968a1d62d3ac24b17ba63e27c616919342f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744044, "uuid": "de37d483-f95a-4969-85b9-e5286fc8cf68", "value": "T15704995E6E228FAEF66CC73447B74A30976923D623E1D684D2ACC1141F2029E545FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744044, "uuid": "7d65dd47-70ee-4d68-96f4-fccb2fbdb571", "value": "3072:D8kuJyI9ugoIUqpC+q3uowjgNXjFNuaien90:D8h/9PynGgFFNuunW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764744044, "uuid": "e6430275-b025-437a-82ca-b6b368a9fbcd", "value": 173604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764744044, "uuid": "81e98057-5600-457f-b657-3a427273ca53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744044, "uuid": "243f8104-66a9-42cc-968f-8aae35aeb126", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c92df2-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746820, "uuid": "e443e9f0-4d10-439b-9f47-5f7d5a94d18f", "comment": "Malware payload (Mirai)", "value": "ddb14f5a5f74bbd034c623427cc1abbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746820, "uuid": "c30d7923-1c1c-4c75-a739-bb3f6c46a8c0", "comment": "Malware payload (Mirai)", "value": "a30d85f2dfd1b463fcc0c7feb9c912e55590c7ec02837b526cd1298010533860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746820, "uuid": "8cc8f8f7-f8fe-4c77-bcc4-481bf3e17f64", "comment": "Malware payload (Mirai)", "value": "5bcd8dbe2f081776c4bdffa547ec1670da809519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746820, "uuid": "dc77b261-2350-40ec-8b80-404c02c1de2b", "comment": "Malware payload (Mirai)", "value": "33dc2ae0a13215439b1bbb5f1eb99afa7e08e4bd7c2124fd83d4ea61a9b0d74f3472a5c59992acfdef2d1fe9e31ad9ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746820, "uuid": "d86d4970-aed7-4312-b22e-d1738acc0793", "value": "T17B2302674785B6708E7D5C709CCB43D39502ED74A0EE33A2A46CE96477C391A7BAB023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746820, "uuid": "ca77b0f2-76c7-485c-9ffb-056fde7f5de2", "value": "768:uoN4ZIT8nOAYw8CSn8412ijhIhZ6jsjqiyHWEIjFqrC1qHnfNq/U+0vOq3UIwY2:CZITNw8CS9kQhIX68TMIZqO8HFq/ULZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746820, "uuid": "8f550837-2606-4761-8f88-a086627e34bb", "value": 48692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746820, "uuid": "a9a8c724-7271-4c01-a5cd-1d3eafec389b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746820, "uuid": "bfe4942f-850b-4640-9b0f-715f850e6fb5", "value": "Yboats.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2936e93-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1764770599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770599, "uuid": "58611fb8-f5a0-4fef-87bb-80de47d742b6", "comment": "Malware payload (DBatLoader)", "value": "2849c3e42e63db15cc641efde1f101bc", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770599, "uuid": "4bcc6cc2-48ef-459e-b324-26494abd230b", "comment": "Malware payload (DBatLoader)", "value": "a36fa05f630b3223180b84b908cd5a6f4a7453b860147bc5c42ecc4936d7ca13", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770599, "uuid": "4580d0b1-d314-4b83-89f0-322f5ab0c59c", "comment": "Malware payload (DBatLoader)", "value": "dd867318e5218d12dc584ae4b8c20edfded4b351", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770599, "uuid": "996368e1-d516-41b5-bd9c-64e1e347bd41", "comment": "Malware payload (DBatLoader)", "value": "798cfd652963c0e77a7e25ce7a3b5cc517ee6df53a0493cd412a06ce911554e9f6a7ab3c1915975f1bd4f8d023c9686d", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770599, "uuid": "e824bb24-dc39-42f2-a96a-23560f2ab44b", "value": "T10E75E166A1F08436E123CAB55C1A938A642DBEB43FB59C5636DC3F6C8F356742C250B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770599, "uuid": "d32513c1-3de4-4359-8485-d604e5d33238", "value": "eb41e5567017c33839f07ebe2eb84cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770599, "uuid": "fab25ecb-9f02-46c0-9de5-a83026254510", "value": "49152:sbiFjbPqyJOX4imcrekRY2lIEEJ9netH:sbiRPrJOxmc8wY9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770599, "uuid": "c6dff0b7-34e8-4123-a653-85ae37cef4fa", "value": 1644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770599, "uuid": "5e793a89-6675-4e6b-817c-d4ac41a58ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770599, "uuid": "f8907f1f-ac4f-45e9-bf99-00cd6ff05820", "value": "2849c3e42e63db15cc641efde1f101bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e93c9f-d009-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764740116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740116, "uuid": "ce2829b5-919c-4ac7-a5d9-4c69a380333f", "comment": "Malware payload (Mirai)", "value": "b5839b4e5274dad54603a82eac34f54a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740116, "uuid": "9fb784b9-c225-4242-8317-123c98685553", "comment": "Malware payload (Mirai)", "value": "a379a1fb4c498addae57e8b84ffba5cf43fe4d77df560af1b44da066403f2dfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740116, "uuid": "56530a21-3236-428c-a9ba-222d56434844", "comment": "Malware payload (Mirai)", "value": "ab34c9ec8a62d82345dc53590ba066b0578f7169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740116, "uuid": "29532ffb-e77a-406e-8716-68a80b6c4a09", "comment": "Malware payload (Mirai)", "value": "cc793fd45c3ad58c5869c35ea2806e5c58c302efd0b69a1068d34a9d765b9cb7ae8ee392f357cf072249db7e156e6d7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740116, "uuid": "5b1b9885-cd48-4d54-9596-9a12832f7c8d", "value": "T1D983025061E06AEDFF22C174EFC390A66CE5477C3B36B22F5D86890DE5BA098D613846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740116, "uuid": "2a02961f-ef7f-4b96-b740-d3a50224f0da", "value": "1536:2xCCZPn9VVZ/aGmtnX+SLozypxhegOk0AMAWB9aWo5vllFapDrq+3Tuuzs5TIM:8P9zZixFhck0AMn9Jo5vVapDr4u45TIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764740116, "uuid": "9c21c0ef-7992-443b-8bdb-61b216f0c070", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764740116, "uuid": "b0fc021d-034c-427c-b660-fb565e70d2c3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740116, "uuid": "98ad8881-50db-4333-8ff9-2a3ae3a82063", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca9ca1f-d03a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764760979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760979, "uuid": "8f0bc846-ebb2-48ac-82f1-036ec34a4a12", "comment": "Malware payload (Mirai)", "value": "c0aedac9470a780b712bb6d56c6b4416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760979, "uuid": "1be15b2b-dae7-44a3-8bac-49655347a3cb", "comment": "Malware payload (Mirai)", "value": "a3d5e3c3e422d72ef0e095e164f2706e250839eaf52e24dd7624f6e3e250f8da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760979, "uuid": "1d3ebc0d-a541-402f-85fd-0935f9c49d63", "comment": "Malware payload (Mirai)", "value": "2c4b438c57915ccb5f4808fe60c9ea1a7c2e1122", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760979, "uuid": "70aa50e0-4113-4328-ab11-6342eb582a47", "comment": "Malware payload (Mirai)", "value": "42a8b38a3f6a963a701885ef6debf4c908afc2367ba4d2eb277e237355e02e539d86f55f93e48cde3c46cca0dea62bc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760979, "uuid": "f083a8b2-0904-4952-bc84-7cc911630daa", "value": "T159B3F855F8929A62C6C256BEFF0F829D332623ECD3EF7203DD185B2536C751A0A7A051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760979, "uuid": "c63f560c-02f6-4493-a33b-0d2369160496", "value": "3072:HL1sdit1kCIks83PVKEjJpREbZ0SrByRvKKkFFtWPBpLOBOQvn5Z:r1sdit2CIkseVKkR00SQRvreMpLuOQBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764760979, "uuid": "cc901e19-f5b1-4d94-8974-7716cb67eff9", "value": 111764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764760979, "uuid": "57f77bf2-d27a-4d97-bf54-1ad547c5a18c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760979, "uuid": "96114da9-ca19-4576-9e81-92cbdbefd098", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a4dbda-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1764770007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770007, "uuid": "e33dc1d5-8fdc-4c7e-9fca-a78a9dd731f3", "comment": "Malware payload (Rhadamanthys)", "value": "a71b32fc32e2b732888af1ab36480bbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770007, "uuid": "8ef8c0f2-b147-4285-ae90-2ec53d2c525f", "comment": "Malware payload (Rhadamanthys)", "value": "a40c0293d30ce6afdb9d825ca751e2d53592c55a86c2859c8e60849cb52c4d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770007, "uuid": "dd2e7acf-f7c9-4431-bb91-3a3655864c88", "comment": "Malware payload (Rhadamanthys)", "value": "e4a997488734ae28bd9a70e4789f6142534ad1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770007, "uuid": "36a02ba2-d4bf-4d36-82b8-8c67ddd08a49", "comment": "Malware payload (Rhadamanthys)", "value": "6de3bc45c0d86c8f4f5f32668e5010e41584ad0e67cef126c8ed1be5e55261f5a26e74d3cf98cd6e6bb391d2ae67c461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770007, "uuid": "9d54aca0-800d-4329-aa11-33b2e84b154e", "value": "T139462389ACB2097AD1A8E6F949516E2DB0BB2DB45740484FF3E8CF4BDC1B1D2473524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770007, "uuid": "3b7cd76e-d078-4b0d-8cb2-37454bd6dd72", "value": "778fcbd34bca6e2bc9d14b70477862f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770007, "uuid": "e0e35e1c-aafe-4e61-8be6-10b777e1ab9c", "value": "98304:GgQoXcSt0dpF9AgeutePEYpIuziBqUh22vXn8lWuvu9HBJaExH8Yd4YU84sN:Lchfle8AEYpIlBdJ/oWMunJaExH8YdU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770007, "uuid": "02bca424-2846-40d2-b31a-c412e687d664", "value": 5384296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770007, "uuid": "3d0a99f3-77f2-4b76-b155-2e1cdaca5181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770007, "uuid": "4da9b843-f039-4550-800a-4ced78929cfd", "value": "a40c0293d30ce6afdb9d825ca751e2d53592c55a86c2859c8e60849cb52c4d72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7786f043-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746824, "uuid": "58754966-1a81-4f9d-aeef-395b13778e60", "comment": "Malware payload (Mirai)", "value": "a71b4ead52ca0b344044f0a645a881f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746824, "uuid": "44803b5d-b871-47eb-ace6-89ee35e05bc0", "comment": "Malware payload (Mirai)", "value": "a41516a742c34feb6fcc2814a4539b74a817c78699935b515fb51f333f29a139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746824, "uuid": "5e23a614-c34e-4f47-be01-42c2d233feb6", "comment": "Malware payload (Mirai)", "value": "730e77a5762a5d87898b3296431c785c18181dd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746824, "uuid": "6a07583d-d805-4941-be00-ccf7d68b8656", "comment": "Malware payload (Mirai)", "value": "026fba9a0f6cdeaf50ebeac7d5a1c254f00af9f4250a18b7bd29692a85a2734e49c7621391f4e68c0df0037e689a4e40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746824, "uuid": "18f118de-1105-41ed-9269-faa10e267af6", "value": "T1ACB3BE61D0A56CE1C260023430F19A395773F849E61B5FF3A589C3AEA44BDDCB25B3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746824, "uuid": "ed13edaf-a9d7-414b-b06a-4a168ca99312", "value": "3072:5V4UT/adsuyBvaLzqJjRNCnrHRn4ShR+/Or8:f4UueDUzqjNCBD4OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746824, "uuid": "ec881094-7f4b-441d-b9cf-577193415612", "value": 116308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746824, "uuid": "d5b702c8-05fd-4f97-b5f3-3518793d3721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746824, "uuid": "60586067-a213-43aa-b46d-81dd16c01c5d", "value": "Yboats.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe560ef0-d018-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746621, "uuid": "ab1a03a0-0e0d-47d3-8383-1ee5444a0214", "comment": "Malware payload (RemcosRAT)", "value": "a8295e7fb9ca0c005f2bbfa9e8cb1813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "valueforcollections-duckdns-org", "colour": "#E40659", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746621, "uuid": "7e14b60e-eaa6-4700-8334-344dbb5cf280", "comment": "Malware payload (RemcosRAT)", "value": "a455a33bb0da467119146ba659140606bc523b43da28a6c08efba9094e6f685a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "valueforcollections-duckdns-org", "colour": "#E40659", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746621, "uuid": "f6888612-74b9-45a1-95cc-d5c98f5ffa55", "comment": "Malware payload (RemcosRAT)", "value": "3c0bf0c4e32fa731c5229fcce4fa2cfe06630efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "valueforcollections-duckdns-org", "colour": "#E40659", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746621, "uuid": "ed7a92af-85ea-44c7-8944-bfce168e6e5e", "comment": "Malware payload (RemcosRAT)", "value": "a2217bef72e46219309f96cfc407cc0b697f2bd3db3b85b01cad340f2610b339c5dab9f0deaeea2c4118be9acac46e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "valueforcollections-duckdns-org", "colour": "#E40659", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746621, "uuid": "f8dda13a-1b1c-46a4-9ad6-c42975fe6dae", "value": "T14BB49E01B6C3C1B2E57214342829E775EEBDBD202875997BA3D71E9BFD300419A297E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746621, "uuid": "1a4bd43c-5e2c-4ecd-8cb9-1442c44ad390", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746621, "uuid": "e5b1c987-874a-4524-b3a0-d5f3e616ef26", "value": "12288:yNZ1w41Go8QvO6DdlUrnZzegsPZ9mTmPFN:yNZ1D1x8kCrnZzQZZPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746621, "uuid": "9d140ba8-c45d-42f5-b13d-05bff6c64316", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746621, "uuid": "60e0ed1b-0fd9-4cc4-ba66-00b10e600504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746621, "uuid": "860d8cb4-0144-4430-8eb3-5d5ee06afac0", "value": "a455a33bb0da467119146ba659140606bc523b43da28a6c08efba9094e6f685a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5395c281-d026-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764752347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752347, "uuid": "bf7aa063-764a-4218-9c1e-799d156db4a6", "comment": "Malware payload", "value": "8ebfe08c3c85648752525f6349e33e04", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752347, "uuid": "946e683c-4594-4a6c-8e3e-d13693a8123a", "comment": "Malware payload", "value": "a4b1bcde7ea271e5b242b3d029e480794afa7dff6edd5e5e7834ffd1dcdc40d0", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752347, "uuid": "a1564c99-7e32-4727-aa98-46b1307addbb", "comment": "Malware payload", "value": "da92193ef02ddae72938c0d4555db087abcba6fb", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752347, "uuid": "70702387-2923-49f6-ac20-d00d4d076975", "comment": "Malware payload", "value": "716d664a145017bee8ee31b3250586c17864c48045c623fd8ff99f711857f0d692d31727884bc51b799314c3e1053334", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752347, "uuid": "aaee553d-261e-4f68-aa41-5d7044cfe3ec", "value": "T17964308126D1AD5927C70FBB371FF4E7E92B0D9C38480147C125BCA07AA971EEAE5631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752347, "uuid": "39d89fd7-fcd1-4d2a-a22b-42468885ff00", "value": "3072:yQrnyGAO0hE5hfatDPAIlIXcWPYY8lSaFXytYdwoza:tNAO0UCtD4IlIXf8W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764752347, "uuid": "b6f0dab5-4ffe-423a-bb0b-89f26484ad05", "value": 307933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764752347, "uuid": "b37ad7af-f185-411d-bf1c-cef479b005cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752347, "uuid": "c3fd55e9-47e6-409b-9707-ff4054923a2a", "value": "PO_(Dammam Port 2 x 40GP).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f929265-d099-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764801625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801625, "uuid": "4ed1770d-f938-4b28-8b19-9f2dfb3b60ef", "comment": "Malware payload (Mirai)", "value": "eee73fd3823f78da899effbf8a4cbbd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801625, "uuid": "58d0bd7b-a1bd-41b2-bd7e-b90bec61408e", "comment": "Malware payload (Mirai)", "value": "a4b7613ac90991a7e31f7eeed6ec1c457f68e4eebdb6607c11351ba8ace26b87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801625, "uuid": "23043aab-6b94-422e-8d95-dede2d0c3372", "comment": "Malware payload (Mirai)", "value": "a4100d60d3f6c19a3325f43eecfa6c2423c0bb52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801625, "uuid": "ad1ab86a-5297-47d3-9659-d1c2f4de721e", "comment": "Malware payload (Mirai)", "value": "6cee68ca7a48a1adff6a186a61d73e471e2a61d6253349ceb58c41fba6922afb790f350d0d97f1c9abebae893c7eefb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801625, "uuid": "bfad1b49-6d84-4686-a0ab-022495c11fcf", "value": "T184C34C8AF4018E7DF85FD9B641274D09F920939166930F6A22ABFD93BC331A4BD13D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801625, "uuid": "d94c1b47-0694-4f64-bbc5-8707a5731009", "value": "3072:UL09p7QKwxvJdqPOFF57NhfiZRhUAuloTxEvahKJ3owyYbfMUnV1wCjXZZmVAJ6V:Wk7QKwxvJdqPOFF57NhfiZRhUAuloTxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764801625, "uuid": "9095e54c-c71e-46f6-aa67-4d8f9a8ea1f4", "value": 120296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764801625, "uuid": "ca1c1407-12bb-48dd-aa10-2ef9a65238a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801625, "uuid": "4f23b25b-19b0-4f3e-9b3e-07cd8156d5a3", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37828125-d027-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764752730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752730, "uuid": "9b2214ff-fe51-4505-9122-68cbb006a665", "comment": "Malware payload (Mirai)", "value": "df1daad24e9e5f41ab320ca3417bf455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752730, "uuid": "4cb12521-9619-408f-bee1-49285c2c2b78", "comment": "Malware payload (Mirai)", "value": "a59d503fa2a762fcdc785ada40273f1263ee6a9722c68987f5f78c98ba2e1c7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752730, "uuid": "0af15321-5943-46c8-9973-b7bcd022069d", "comment": "Malware payload (Mirai)", "value": "2e26dd4267ca4bac2ce10a3135c9b52150f90411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752730, "uuid": "63f19aba-da78-4ce6-a9bf-88cb40c09e2d", "comment": "Malware payload (Mirai)", "value": "e38907537a84bec6f3c612e82cdbc7ad3b6d1204b31da863b99193ea6e2f0a1dea8b4dbea31caf146be6c0d5936c31f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752730, "uuid": "f6993e22-181e-407f-ba26-bb67114c0ea2", "value": "T1E2C32880F98B81F6C80B883820A6F63FDE31D9E941738A5DEF959F36DF3B5419111689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752730, "uuid": "c1d2b131-ad43-4a52-8bce-60b28a8bc5ac", "value": "3072:tsU6yvtkutnFxnZiFA48O8o01mRwlFiIsOWUCNybFwS:vVkQfnZi+4+bFld40+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764752730, "uuid": "1113e626-78c4-4ae8-a1a7-4b82350b5780", "value": 120304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764752730, "uuid": "133bbe2f-88d1-4ee8-a70c-518c56ac7b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752730, "uuid": "c2dad54e-272f-47bb-972c-55a6bd7bfb26", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13db85bd-d07a-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764788318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788318, "uuid": "1f50605f-67e6-4965-ad7f-5edc0cd7391f", "comment": "Malware payload (LummaStealer)", "value": "bac8f02dca8b63623a9b28eaad747813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788318, "uuid": "71ed25ac-ccdb-4414-993b-d1aa1c09fddb", "comment": "Malware payload (LummaStealer)", "value": "a61dddb469f669b6cc0520593ac23c9f54761070cf700dbe5c694cf34215538a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788318, "uuid": "e776c065-4ea8-494d-8000-d557d1ce8cc4", "comment": "Malware payload (LummaStealer)", "value": "b54956705156ad0cd4c9a86b886e7d69ff362523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788318, "uuid": "0d0a7cb6-9e62-4181-9a96-19a4873d0fdd", "comment": "Malware payload (LummaStealer)", "value": "19103a89fc6c1d92d0f12e253a43b7d888c9440fd4ef686f77490042eec24ef90b2cff29b4ec9f9f9d169ff915d2c206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788318, "uuid": "bf31040b-efff-48a6-8ff1-4828ca3c06af", "value": "T183E61294DB660472FA7727B58DB36693D03A3CED5230C26F42C87A1A26723217B1E35D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788318, "uuid": "ff37363d-fc8c-4d01-b9e2-63e1f9835322", "value": "6e3701050005cd9a83704e63233d66c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788318, "uuid": "dc91da60-ea8f-4a8a-b61a-1228a11460d3", "value": "393216:CKzOx5UXEId+4AHWra9WPkjAvJpVssdQnzB:xySXndkHKk8rVssdQnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788318, "uuid": "3cb0a910-b9b6-47bc-9e93-4edc51235eaf", "value": 14556240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788318, "uuid": "c8205ae7-e52d-4c9d-adb9-42ab1cd08ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788318, "uuid": "c3aa6ae8-078d-42d9-b43f-0a5501ad38cc", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f42994a-d082-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764791961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791961, "uuid": "9ca19110-bd9e-4bff-88a0-fefc9325b099", "comment": "Malware payload (Mirai)", "value": "1f9129c6565a74c54ba733290f9c88d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791961, "uuid": "2d536441-4a67-4272-b543-3e2832d19957", "comment": "Malware payload (Mirai)", "value": "a63d56d0add0d6a501f1c86abb5e4762f4a9f35539c1def65400d35b9f645d38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791961, "uuid": "912c97f2-ff6f-415a-b9fd-fa566a7859be", "comment": "Malware payload (Mirai)", "value": "53ae501e547bfa6536c948d8ae41c0444e45b616", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791961, "uuid": "6b956850-14e8-4b01-b026-2f569704e069", "comment": "Malware payload (Mirai)", "value": "13712aa0cde85a1dd4472f645bf577756ceec9a9472a4a66873882b4985a437a0f1c077de5a44b9a3b079f687761c6b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791961, "uuid": "89024d11-920d-4c78-9703-bb642574f4eb", "value": "T15D044C56E7418A13C0D717BABAEF4245332397A5D3D7730699246FB43F8279E0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791961, "uuid": "3ee28849-0b2c-456e-96db-2623de5996b7", "value": "3072:GxktOitbO+AAagk4B/YnGswmhsIXaks/1+XUnPM/9CY3tZ:sksitalAagk4B/YGsvsAaR/UXUPM/9C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764791961, "uuid": "d81ac93a-35df-4b36-a908-6b057784671f", "value": 180727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764791961, "uuid": "9d7ce2e9-8e6a-4852-84fb-c080ba0ab2b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791961, "uuid": "16d7d64b-cf67-41f3-9149-dfce41e000fc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290b9594-cffb-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764733808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764733808, "uuid": "d5cf738f-2216-40cc-9581-2001ada8530f", "comment": "Malware payload (QuasarRAT)", "value": "09b0a41cce5a5ce2d0566c467c16e04b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764733808, "uuid": "8d867ec7-e037-4f33-b0ca-ce85feb8f8cc", "comment": "Malware payload (QuasarRAT)", "value": "a7148acaabcee8323ea08dc1c3547c79cd0cab58a7b30a6bff16e721c194c9cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764733808, "uuid": "95ad9483-8f0b-49b0-b6cd-0d5c0e00a7bd", "comment": "Malware payload (QuasarRAT)", "value": "39f79a0feb07f6f02635700fa7f8abc9af6f04b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764733808, "uuid": "92403578-ceb7-4184-b9b4-6a4f1f667cbb", "comment": "Malware payload (QuasarRAT)", "value": "22c87dd28363f0bb397650da14b0b3a8d8218c8ce48da739d8511628fd1f7077516b8f6ddbfcd1808e928f14255c1039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764733808, "uuid": "482af85f-2f93-4348-9df5-df4cf8e3d16a", "value": "T1CAE55B043BF85E23E1BBE27395B0041667F0FC2AB3A3EB1B6591677D1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764733808, "uuid": "6b9f964e-de83-4163-903b-d4833a85af01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764733808, "uuid": "f064dc6d-085d-44ea-830e-b160a332737a", "value": "49152:fvzlL26AaNeWgPhlmVqvMQ7XSKseDiEQsekCxSLoGxqTHHB72eh2NT:fvpL26AaNeWgPhlmVqkQ7XSKseDuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764733808, "uuid": "5c97c856-4aa9-48e4-97e5-db34d196c16f", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764733808, "uuid": "e210b329-2cde-4a9d-aafb-2466d2dff234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764733808, "uuid": "48305489-47da-4d63-b30a-09ed77dd9f9d", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc7b07c-d011-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743479, "uuid": "4c7654af-c936-40c9-bb16-510fb1ce8e33", "comment": "Malware payload (Mirai)", "value": "623231f7c30197035a344295685ffc31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743479, "uuid": "8f85fdd6-9c9e-49c5-be13-8567bc620868", "comment": "Malware payload (Mirai)", "value": "a74b907fdaec7f78b4e6110bec9dd4a5a7dd4af16ab6169ae172f702624b16de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743479, "uuid": "2675c370-8a6d-4716-af7e-c598385dcbd9", "comment": "Malware payload (Mirai)", "value": "5920f01db9a609603f0ff1ac763e09934a0f008b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743479, "uuid": "66026e9b-ed89-40e5-8c6c-39b88d0f452f", "comment": "Malware payload (Mirai)", "value": "93b59093a6552c1854d1fe1c9af9e1bc60cedf2de8f261dc76074de2f72002be63e6cae219c8563c2f4e9397e10e4c2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743479, "uuid": "d2691512-642b-4db3-a031-c5013e28048f", "value": "T182B33A0779C88CFDC055C23407BE7937DC21F0EE0238B29B67D4AE26694DE720B29A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743479, "uuid": "25041b65-4f2a-4682-a474-3a236fa3038a", "value": "3072:uy231pM1hUxKVNJs+NX5Y/QYXFjE18dya5bdC4EQ:uy2lu1hUxKVNJsV/b1aZ+bQ4EQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743479, "uuid": "309ba139-b1b6-4eb6-b7b1-62df0570690b", "value": 117216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743479, "uuid": "c953d8ab-f28f-493f-abd7-0c6c72a99db0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743479, "uuid": "243bbf32-2094-4c83-9faa-babf242eefeb", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6962080-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764749507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749507, "uuid": "9d0151e1-df44-4e2d-8f2c-641b8f000a0d", "comment": "Malware payload (NetSupport)", "value": "dad3089909799c7a37b0f082b274ede8", "object_relation": "md5", "Tag": [ { "name": "dof", "colour": "#244CB1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749507, "uuid": "f4ccc96b-55d7-4dcc-a7ad-b90a0a0dbf3f", "comment": "Malware payload (NetSupport)", "value": "a7fa6160b6058c914c7fee03d0c5a75e0073ed0b7002fd78e477155ba4c63c36", "object_relation": "sha256", "Tag": [ { "name": "dof", "colour": "#244CB1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749507, "uuid": "13a15938-06c5-495a-a935-8d6faea7449e", "comment": "Malware payload (NetSupport)", "value": "3f1c373a4b43a10af2995b2f90523ef1af2d7502", "object_relation": "sha1", "Tag": [ { "name": "dof", "colour": "#244CB1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749507, "uuid": "58f24e1e-385d-4053-a7fb-c9d8cd63cf0e", "comment": "Malware payload (NetSupport)", "value": "f9196250df9d3a1faa6afc9d62834f2d43cdc30322fdde4e9785e14e9f3d971753bfe6402244efa3ee636b173cce0885", "object_relation": "sha3-384", "Tag": [ { "name": "dof", "colour": "#244CB1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749507, "uuid": "3574fcaf-4db7-4539-a7a6-9344b932dec1", "value": "T18EA67CB88B84975EAE6E1A07E079571F67F33F66D09271FC5A623707216FD082239C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749507, "uuid": "ebaf7f15-eb1e-4619-8809-13e8b59f14bc", "value": "49152:8Q4+ye7k1IvGaA1UzZtMgLXtKKuaRGw66Q7b0AIbsaqb4VbEUCOkc:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749507, "uuid": "b1d4223e-292c-436f-8c2e-0c887df20b94", "value": 9584363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749507, "uuid": "aa7920e4-8f94-48d5-a53d-edc7c9e3d62a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749507, "uuid": "976f9dc9-f0c5-4c5c-8e5e-c8a958da824e", "value": "dWX.dof", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5eb9bf-d020-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764749736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749736, "uuid": "ba5b7dbe-8fda-4b7d-822f-e02f529dfe36", "comment": "Malware payload (Mirai)", "value": "f0841290c048463916aad4e83a7e51bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749736, "uuid": "639b0538-96f5-4c3d-b087-979a19cb9587", "comment": "Malware payload (Mirai)", "value": "a830d0a385366de3f9929b41c9d2c26444286caa51b9b83360a54b55bc52b0dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749736, "uuid": "5909c799-d822-4e31-9332-4d01f0c6cefd", "comment": "Malware payload (Mirai)", "value": "da5762937c54d4f0e7f19552d56ee7a960821f5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749736, "uuid": "b42dc0b7-21d7-416c-bbbd-bc6369d4c515", "comment": "Malware payload (Mirai)", "value": "9958976ff7fdcbd2ee27766b714a3b579745ddfbe58e3c877c37a45cbd9335add64d374d1067c6f4b2f64570ea13dad0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749736, "uuid": "34c7de8d-8feb-4c0b-9c7c-417b277b58f4", "value": "T126C33942B8828A23C6C713B6F66E61CD372123E5E3DE7207CD259F21379661F0D6BA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749736, "uuid": "d2217dbb-ef1f-4adc-a9ed-8bc5e5ee2c49", "value": "1536:JkLi8ceCRfG4Bg+npugQvCMsz0tspUzsnsPKyjuGlG+j9XQuBGzoAqg3vK2v:Jai8c24T0W1nsy3v+j6uBnXkK2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749736, "uuid": "2fe9c8cc-7fa7-47cb-b321-1f48d28eea95", "value": 121740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749736, "uuid": "fd43b0c8-fb4d-47b7-8e2d-890f4ab66e7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749736, "uuid": "5fe38410-06b4-4cd8-b3bf-53e5e00d5b7d", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acea151-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764770022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770022, "uuid": "cec4535e-1e59-47ac-99d5-a342875def9f", "comment": "Malware payload (SalatStealer)", "value": "61a637f731b2d38450c99cf350414aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770022, "uuid": "26d8216a-6a67-40a3-8136-f0f21bad8ccc", "comment": "Malware payload (SalatStealer)", "value": "a858133c5c1865d12abd0b22b1bb77bed26b01da769737af1392add9f244b1e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770022, "uuid": "9155cac0-a5f1-444c-9ad0-30091cb5fee7", "comment": "Malware payload (SalatStealer)", "value": "b26ccc829a60c965c401481a94d3c554a2bf81cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770022, "uuid": "5ae44c8e-96b3-467f-b8de-02c9e9b74cbd", "comment": "Malware payload (SalatStealer)", "value": "f713bd1b73495a9bcb0cdcfc366ff6a0109cb83c20b2f5a94d7044f3028de6faccbcef6af2365df37c5607431875b4af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770022, "uuid": "c097d458-f658-45b7-ba7d-81be2c1435ed", "value": "T11AE533FC0877AAAFC7953BF9F3110363467FBCFA87449412A138225D4358B6E5DA241A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770022, "uuid": "225eed3e-125d-49e8-b271-c6b2ea8caf1d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770022, "uuid": "78c84106-b651-4930-b8ac-ed260db6fb98", "value": "49152:XY+nWRK86AlhQA7Y9c0sp0kQsLp1b4cCpiAWIYYxErg1/oLONYVRKnapFBJgDM3n:XBLdbdkpLepWIjxLai+fKnALgDpX798", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770022, "uuid": "2afcee35-0544-42d5-b370-53e8ef531040", "value": 3291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770022, "uuid": "c4a48365-3d75-41de-9ef7-d46f3ec07121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770022, "uuid": "5f7546fd-475c-486c-80a6-a6c2f754b906", "value": "61a637f731b2d38450c99cf350414aff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6977c713-d01d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764748519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748519, "uuid": "1b8804a7-0815-4441-a79d-d65c1c745fde", "comment": "Malware payload (Mirai)", "value": "a452ca05c956850e58cdba6cc2dd08fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748519, "uuid": "a7c30cd0-3acb-428f-8eca-7f81e2446c61", "comment": "Malware payload (Mirai)", "value": "a85a4b7fb6d4ec7ed287bd418bd62e45ee1e6363f0d910e3e74cfe9e205e6bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748519, "uuid": "1ef70708-7515-407e-ac34-8f4325de2f37", "comment": "Malware payload (Mirai)", "value": "d5c1d8901f17aa55a18222390ad3e1999c531e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748519, "uuid": "7059db35-97ac-4955-be5f-b81adef5c42d", "comment": "Malware payload (Mirai)", "value": "e3e070e6e1874bef60f17f56c2926aa439c49a3fe9f5b4dd5a70244f638a79bb086f85d70e21c5fe3ecd8a11e7d30203", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748519, "uuid": "3681fdd0-a1c3-42e6-9b2b-99bb9984b577", "value": "T18D23F175DD5690B3A3C05FB158283DCB2B2707FC123BB63A16510D3C336AAA3ACB9456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748519, "uuid": "78a5e48c-eada-4bba-9690-a68b67e24b00", "value": "1536:/0mK9fKuNFzYqxP1CGUqH4co6Zgkr+Qse5Lc:/03KUtxP1C744coo7+QsALc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764748519, "uuid": "40574e9a-5836-4f1b-a304-4081f5f43cb0", "value": 49328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764748519, "uuid": "83314db1-d4fa-4ec3-9470-c5ad2ba18888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748519, "uuid": "38289f8f-d6ea-4e90-ada8-f458dcd6b95d", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1097b0af-d026-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764752235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752235, "uuid": "c307891a-04d9-4bf4-be98-d8fe36163830", "comment": "Malware payload", "value": "988e719ed981f955a2fda57ef82f05c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752235, "uuid": "575d4180-c0a0-4a20-8ebb-918f7a019f99", "comment": "Malware payload", "value": "a86fb75f72aa6087e19a9241ef2057669fa3beef18542fe3d3e7c8505157c88d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752235, "uuid": "b8fb9980-b36b-429f-9f03-aa76fff6662a", "comment": "Malware payload", "value": "8980181ea6cb4aeedea5a74b5fc57ca67a29e1f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752235, "uuid": "c2f43c3b-5b90-4913-bb22-025fc48ac833", "comment": "Malware payload", "value": "2e67bec2c8bde7e8f3810beb7ddd0713dac343aea2199230a25dd1f86527ad4235d77dbb53efd1a2bca5f2af14f6a6e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752235, "uuid": "ba950170-3249-441b-82ba-b1b8110bed59", "value": "T139E6331BEEF136DEEBF60AB119F48C9AB92191690354FE6726273F9509C31D10FA110B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752235, "uuid": "91a5860e-2569-466c-b2ae-5acc7d5faa71", "value": "22402abe221b6efa466ca4190864858f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752235, "uuid": "367be7e0-b46f-4ac8-9ed3-b3b6dee50c68", "value": "393216:NJzWUq3UKKeizYH2jBkzv7qZ/CMKGvZ/0ZtCHf:N5W1nezCTzDAC1GxvHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764752235, "uuid": "91c312d7-c1ba-41e7-9bde-28dba4cdebfa", "value": 14542352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764752235, "uuid": "0668776e-4eb6-4652-9217-1be6063dfdd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752235, "uuid": "735cf5ac-7e63-406e-aa01-57ddbfc7576f", "value": "mzSeCT06HitK85Fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98fb99d-d040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763766, "uuid": "d832bb38-e5fb-4dc6-b6e5-98375902302a", "comment": "Malware payload (Mirai)", "value": "51f2e64d8a1c8eeb4641264a9c5c0d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763766, "uuid": "6b4e99ce-4b38-4deb-977a-a3e136ad8115", "comment": "Malware payload (Mirai)", "value": "a8a1552be0e3cb87561624788c2ef3898812465ddd432337893d4bed75133f71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763766, "uuid": "61a68f2e-eee5-4f45-95aa-85f1c4a96292", "comment": "Malware payload (Mirai)", "value": "2ba510c61e18b7e2f3386cd81a1547e40322abff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763766, "uuid": "adc94837-9286-4b3b-ae66-1921fb634d2d", "comment": "Malware payload (Mirai)", "value": "452ce804704e09b4e48a4bf70c16b0e37fdbc987c46568017f26110cd0c64b5868b62d69ae95680f236fb9382af36e52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763766, "uuid": "e26ac6a3-87c4-4c7f-8ee7-fcf2612703dc", "value": "T1C76302A5E3D3E173E6591C7BDA724917324B1EB1970C893AA70C168BFBD7AC458BC801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763766, "uuid": "e9c165c9-85f8-4a44-84f4-01fc0e19c278", "value": "1536:EpgOEjxRCpuyTZXGu/80y27sWcsTDm6clX7OXKH1I/cai:GEjmftGu/8tWcx6clv1Ocr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763766, "uuid": "698cf49a-d25a-4682-bfb1-a9e3a24ea480", "value": 71536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763766, "uuid": "cc7a479e-f440-45e6-bf3d-a5b7e96d1d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763766, "uuid": "81a49f59-9281-4f60-9c81-94f2410813e4", "value": "Yboats.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c973f379-d055-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764772731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772731, "uuid": "58260494-084a-4efe-a176-78e30dc2b957", "comment": "Malware payload (RemcosRAT)", "value": "31ef322c6d5c662f78cc1ec2a164c311", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772731, "uuid": "fe8f34be-e445-4f50-86b2-fd302d345d94", "comment": "Malware payload (RemcosRAT)", "value": "a8a5995f30fddbd3ad4d2f1538e724c508a9995245e6a753fe4da82b803b6b0e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772731, "uuid": "30c390bb-a5bb-4adc-90de-f31de890bccf", "comment": "Malware payload (RemcosRAT)", "value": "68bc8fb38b0174a232696cbd7628233c22fb89fa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772731, "uuid": "f94979bf-2ae8-4c63-8ecb-e2453408fa14", "comment": "Malware payload (RemcosRAT)", "value": "ad929745545e2ae2cc111caf2b7954340a95d94204bf0544b9e4791fc75702daf9b50b7d521ccd01b3f644fb33ea3162", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772731, "uuid": "e4d2691a-8388-4f44-9b87-de8fddfd829b", "value": "T1D5E109553E03B0272210CE2EAD4C82D90C5582C3D4B6A3357A2DD9EFDE64A6473BF25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772731, "uuid": "f2d95647-9fef-4d9a-ae5e-0811bec3ec8a", "value": "96:rlJhgng5h/vCF5j6UTq3d3YdcH5xqdG1MhMcRdLgzqPXGfnsjy8NctdihIq:9gng5h/y6UO541CuLgzsXKsjy8uQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772731, "uuid": "f68e4172-4440-429e-a514-4cc1d5665941", "value": 6811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772731, "uuid": "bd66e814-d5e4-4dba-8990-fc0c92a60007", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772731, "uuid": "8e220b94-f887-4e4e-a5d3-1029fc41c091", "value": "SUPPLY REUIREMENTS FOR FOR IMMEDIATE DECEMBER BATCH ORDER (PR CF51308 FOR PRC TA 2025 RF Purchase Order For IN N046687 pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f496a550-cfec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764727707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727707, "uuid": "ff3359c6-5de8-47fa-b0e6-c8f983fdb046", "comment": "Malware payload (Mirai)", "value": "406bdbce8dbf1a4f87818b632424825f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727707, "uuid": "3095ce88-a061-495e-8237-4b2965e3f083", "comment": "Malware payload (Mirai)", "value": "a8e5233a5439c5faaa71efdace94713050fe799ab79610a1d6d8dbda3e9a5b77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727707, "uuid": "b777572a-5fb7-4263-a983-6627677b36ad", "comment": "Malware payload (Mirai)", "value": "f4da7ade556610ab44921b51127ffd2f68c38029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727707, "uuid": "7b6c75c0-da9e-40e2-ba58-f7b9bf17720b", "comment": "Malware payload (Mirai)", "value": "da7d45cd07d45587f14a96ae3f0b5526bb763636226e68ba7a6880d6a84c97717b1e16bab413c90a94c790028987256a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727707, "uuid": "470d0443-375e-4562-941c-498e08e02d4b", "value": "T12ED31A56E6814A51D1D608F3BA1E2289374B43BAE3EB7103ED150B60BBDA51F0B37DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727707, "uuid": "0f7ace6d-46c1-47ca-9735-a2a37788ab05", "value": "3072:hySoWIgmAM6ZIlfohoQjxigmaktwiP6ZlY:F0fTlfoh3jxigmagwoKlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727707, "uuid": "6abac736-3008-446d-9767-27081e874ad5", "value": 132956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727707, "uuid": "4e419a8c-bda2-4f31-8d09-219fca519bad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727707, "uuid": "f15abd37-aaad-469f-a4f8-43ca1102ec05", "value": "4t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966cc1c3-d01b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764747735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747735, "uuid": "23710199-56df-4335-9550-1d269deca870", "comment": "Malware payload", "value": "e4a7a85feff6364772cf1d12d8153a69", "object_relation": "md5", "Tag": [ { "name": "APT-Q-36", "colour": "#748642", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747735, "uuid": "956719c8-0d95-4bbe-8ff4-a663ef9a0b5a", "comment": "Malware payload", "value": "a943b5b03b31604830766f41187f65dff2f18d9f7dcdb4241b375a5d95aaa043", "object_relation": "sha256", "Tag": [ { "name": "APT-Q-36", "colour": "#748642", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747735, "uuid": "42d4484d-22ba-47f2-8f02-7ae2b0221398", "comment": "Malware payload", "value": "357221ac9f603b0437c6ac54448a0ead4a27276e", "object_relation": "sha1", "Tag": [ { "name": "APT-Q-36", "colour": "#748642", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747735, "uuid": "26a817c4-7b63-4cfb-b274-b80abc4aa2a3", "comment": "Malware payload", "value": "6101dd3870492f2a286301e35af742aeb5ca0e27c046516c252f72c6cede0556ccb552da61f48e02a99f79e0ce149818", "object_relation": "sha3-384", "Tag": [ { "name": "APT-Q-36", "colour": "#748642", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747735, "uuid": "8ae661ba-8316-4fdf-ab2b-28341d148cef", "value": "T1DD55BF51FA83C0B2E19102B1357ADBBA4B3C6934076294D7F3D43E76D9202D16F39A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747735, "uuid": "5e86be0d-1fa1-4d3e-bcdc-8dffd7e01de7", "value": "181323cd91ed2fb1c574fe9b4b5bc58e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747735, "uuid": "4ed6c168-00a7-423e-bb83-dea49d8f8312", "value": "24576:8VgDy2LFet9MZ39te6iuzElto6K4XOmSm5fdWp01q5DixWatE:YnseteZ39tejo6KOV551qMwatE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747735, "uuid": "636b2b32-376b-4b44-820b-4e70c9cfacc1", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747735, "uuid": "2818beac-376c-491d-a87a-cfc4d6765c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747735, "uuid": "2adab54f-4aec-4a9d-b71b-678e0990df3c", "value": "a943b5b03b31604830766f41187f65dff2f18d9f7dcdb4241b375a5d95aaa043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7374a6-d055-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764772686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772686, "uuid": "d2733448-5c68-416d-a8ee-60d5aeb560be", "comment": "Malware payload (RemcosRAT)", "value": "2d6f6e0cb1078b6968c2b5318c7a4fe3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772686, "uuid": "f0144522-c74f-444e-b372-a9a968799127", "comment": "Malware payload (RemcosRAT)", "value": "a98c97b01854bdf27ee6ded0ef6bfc091005a3285fcd626b0d43a3c93ad7596b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772686, "uuid": "6f3595eb-f185-43fb-99ed-163dd731b262", "comment": "Malware payload (RemcosRAT)", "value": "da4426cb57ea8f12fc447cd70e8ea1b6dc8d2639", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772686, "uuid": "11006f19-32e5-4f55-b5ba-e8b8b2013739", "comment": "Malware payload (RemcosRAT)", "value": "21b174c13872af9d86a791a24130920887aa8e9b74a203a40cdf27dcfe731fa153f84e649c55073de25e142c4bdc964f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772686, "uuid": "51efcdc3-9160-441e-aa1a-453fae9a37d3", "value": "T1C6816D1A94CBD9C1F4EFE879794D8301A48943B706138FB4612E662C05FF116B921FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772686, "uuid": "1dbc00ff-3ba8-4a89-bb80-f047a34bbcb8", "value": "96:VNYVX3Tjdioy+4plgWqZxQm1D9KDIPltURlB5LZs4FXc98TRhZA4e5+n:23Tjdioym7JhZWRlnvXc9Aje5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772686, "uuid": "ce23f8a7-c4fc-44a1-81cb-16602413cc6a", "value": 3888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772686, "uuid": "fb04b696-de56-4b4d-8903-159bd0d6e224", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772686, "uuid": "b6dbd96f-1496-45ae-8d27-b59b85bbe85d", "value": "SUPPLY REUIREMENTS FOR FOR IMMEDIATE DECEMBER BATCH ORDER (PR CF51308 FOR PRC TA 2025 RF Purchase Order For IN N046687 pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a891f56b-d050-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764770529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770529, "uuid": "e2d9471c-2be5-49aa-9a37-68802c8e74c1", "comment": "Malware payload", "value": "69e2f2e0f30a476accc4372dac977fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770529, "uuid": "6be39479-69d0-4215-83a8-16f292d66c7b", "comment": "Malware payload", "value": "aa32d0e1e89a6522ed3e924cb3cba375dc0fcfe48c9fe15ad5309534b91826b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770529, "uuid": "c32bb113-2355-4fa8-a472-ba7ae640fde8", "comment": "Malware payload", "value": "1b5c0605b8a10320e9d102a59533aa570f10c1f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770529, "uuid": "53f81efc-7ea1-405e-a779-355f165ed36e", "comment": "Malware payload", "value": "ab6dfb3d2bf538a201b0b426c3a888050fce8d01583041c5e29c6e93ec6d46fa2985fe2b8bc5fd497b34fcb11cda04a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770529, "uuid": "065b6fca-94ff-4703-8581-9b205a96805d", "value": "T13CD63324B3A004EEFDD7E13F696181C273A2B5251BA1CADF17A842A83F275E41E3D754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770529, "uuid": "219ec484-cb67-4014-9999-e8f188ecbbde", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770529, "uuid": "1db9e606-f232-4173-8af3-f14ef670fe40", "value": "196608:3TZGANatbW897Gftr1LDsBTG9WdSlndz4k1um75Iv305WR6HOCVkXnUnaL:VGANa1q3sB1onpDJFIv3Y3HFyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770529, "uuid": "4a8f735c-5075-4e37-ba3a-c909ea568eaa", "value": 13029413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770529, "uuid": "b0715dbc-89b9-4a27-a1ae-51d1162a515b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770529, "uuid": "7ed6aabc-f5f0-4881-9b2e-d5fc0f1967a6", "value": "MaxData.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f609d1-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767375, "uuid": "e75d95b2-18f8-42b0-9a80-c7c04043fea1", "comment": "Malware payload (Mirai)", "value": "4aed18414c7b8a174a1bd5f336a2a88f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767375, "uuid": "6ca2ee14-00cb-4d9b-98e2-0c20fda8eeec", "comment": "Malware payload (Mirai)", "value": "aab9f59c51914db48b6246272529f8865a4eb472210d677d67c997c4b41841db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767375, "uuid": "1db12776-37cc-4d69-b367-9cb95cf7d937", "comment": "Malware payload (Mirai)", "value": "d2b0ee8c13adbcb4e5baadcb87bb7c9584758dd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767375, "uuid": "6d57bcc3-8996-4626-a9f0-63823794f720", "comment": "Malware payload (Mirai)", "value": "752972814420148e50c039d6e2cb4a6ba542c148299ddb75ded5221e0edf37b49742d532de549edab47b823c747306ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767375, "uuid": "68d74791-23c1-426e-94bf-45f1051e5acf", "value": "T1A3E32A46E7408A13C0D6177AB6EF42453323AB64D3DB73059928BFB43F8679E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767375, "uuid": "9110bbcf-3119-44fe-80cd-69068fd9878b", "value": "3072:TVu+Fe4XalHzbx8PogNLCz7QHE8E1LNJmM/9KIS:TVuQXalHzbx8PBNQ7sEH1LNMM/9nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767375, "uuid": "f7cccf23-caa7-413f-9e2e-7ce902614d3a", "value": 154279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767375, "uuid": "503e2702-c7fc-47a1-abc6-0ce74d37c9be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767375, "uuid": "a6590812-ebc6-4986-88a1-6120f84a89ea", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62ccd07-d06e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764783544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783544, "uuid": "d7cf8549-ddf6-4322-b2df-2332af98f725", "comment": "Malware payload (Mirai)", "value": "c5d40ca32d8370427c9e4a6cf5267405", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783544, "uuid": "983c5861-7e5d-4455-9b81-5cd88b43c26a", "comment": "Malware payload (Mirai)", "value": "aacea65e907af9e69c18064315be996f996a3e959384565324ce5dc267f26574", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783544, "uuid": "5480e07b-f352-4b54-97b1-d3202f3d18d8", "comment": "Malware payload (Mirai)", "value": "df4517478e7caa7b5a3705c4f015e6e8e0f2f635", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783544, "uuid": "0b092f4e-3d9f-497e-8945-9dd0b4e09e41", "comment": "Malware payload (Mirai)", "value": "7d2677814b26cce162caad52dad7c506062b524ea91ba568f858e1dfc207aec81981b349306c256181a523d099ea2cd0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783544, "uuid": "10c1c71d-c667-40c8-ad1f-00eb8a815fee", "value": "T1C151B3CA12524F326CEED92F77A588887084A9FB74C6DF65D9DE78BE04CCE0C7005A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783544, "uuid": "f2970266-9639-4da1-8fb9-9e29e8edb03f", "value": "48:/DOtDvaD8LD/6DpsDRtiPDtitdJDatD5+jD2uODbiD/+DILDEA0DjN:/o2QWqf26JImoCaQT0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764783544, "uuid": "281d7434-1d22-4d3e-94cb-d6400204c50f", "value": 2571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764783544, "uuid": "bc642f86-b8f1-494b-83df-65d1792052a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783544, "uuid": "438f09ec-c0d8-4107-8e70-a398f25538e7", "value": "sshd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27ed3ba-d08c-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1764796396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796396, "uuid": "89dcc232-29d5-4a20-8da3-9f45bad2306a", "comment": "Malware payload (Amadey)", "value": "32dda9f2e60718811e8e8308a620ea85", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796396, "uuid": "78bdd429-df1a-4a71-954a-46dd38c157b3", "comment": "Malware payload (Amadey)", "value": "aad0a60cb86e3a56bcd356c6559b92c4dc4a1a960f409fb499cf76c9b5409fdb", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796396, "uuid": "e0f17e4b-f15a-4879-988d-7793d0dd1fd3", "comment": "Malware payload (Amadey)", "value": "281a9997ac902cecf6748496d8b5e687e6ebfe70", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764796396, "uuid": "5f2125a4-182b-4945-9859-b1b47b04c7c6", "comment": "Malware payload (Amadey)", "value": "5a6c57d4312fcb6ac7122c27f42afa00787d13d2613077359f0b58fba24648e12fad9ea6f151a6e990021ec6dcec1750", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796396, "uuid": "0e1d0069-eb50-4328-a0a4-bc4e30612ec7", "value": "T114148C243680C072E4B7027145FC9B32597DBE620BB15ADBB3E80F9D8AB45D26B31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796396, "uuid": "3bfbd5b4-ff40-4e11-adea-cdeebabaca8a", "value": "9d20241135260a6283527b95f11fc551", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796396, "uuid": "a57d806a-90d3-4d1f-88c1-8f206dc23c58", "value": "3072:CLkiHgZn7CNFBneOI7Aeq63oNZErKypSiDX9I24+lgNd+s0PWMelS:CLkiHC7JOI7+5ZErWk9IHDd+sUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764796396, "uuid": "25af7a21-3607-4d94-b644-cea775b7e559", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764796396, "uuid": "5543c245-a854-4e34-9f56-ecf21ccdec27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764796396, "uuid": "9f924e55-26ff-4d9c-87c9-b39c0aefb7c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f74329-d010-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743114, "uuid": "3abe6f01-b9c9-4acc-af10-21cab4d7dd2b", "comment": "Malware payload (Mirai)", "value": "2efc7ddb3988f1b66ee2344df5920560", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743114, "uuid": "2f670c3e-2636-42d7-828c-f05df09c6101", "comment": "Malware payload (Mirai)", "value": "abd9a727cc9a9166c6bcd1e355a74e64f46feafb4b89c21e5619081c24ccd994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743114, "uuid": "beb9a879-b1be-49e0-a904-548b07cd9637", "comment": "Malware payload (Mirai)", "value": "8e70c3e43805f493ae845a125407d7653c987cbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743114, "uuid": "12944e5b-f2a3-42cc-9663-28cce0bdb0ad", "comment": "Malware payload (Mirai)", "value": "e88323140b2b0d7fd552bd48875a7fb8c3d09937724e829a75ffbb2f07ecf272ca6740498d344514b67ca5c208015b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743114, "uuid": "709db01f-ec47-4fb1-988c-61dcc8b302ef", "value": "T173630276F712916108F01896DF7046C62C0CC6F8B2B74867915CECCFB9A3ABA3D5DA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743114, "uuid": "e9d5431a-877f-4a20-a0e5-87cb122d0099", "value": "1536:NtC8Z0Lwdx6DGLqKQ0mjEan7Ms0cDCcdv+LmHIBcm+7twht7:N4sKDzKiXFZjkLoI6DtG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743114, "uuid": "0443509c-c2f6-45ec-921d-757900ec9963", "value": 72504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743114, "uuid": "d5613561-d151-4d29-b0d2-23d5598bf0e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743114, "uuid": "a10dfff6-665f-44df-92e0-4c91a1e579d0", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc32f30-d022-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764750645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750645, "uuid": "3c5d59ef-ff92-4e8b-bda5-9fcddf85c3db", "comment": "Malware payload (GuLoader)", "value": "063d6c40bcb05c6f376ba22da59268ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750645, "uuid": "c8ae7d3b-25f2-49e3-bebd-de24be2a40df", "comment": "Malware payload (GuLoader)", "value": "ac89ec65649c4999f8e2044999e0c17c38b39d6690c935989b9648491d45ac12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750645, "uuid": "3d2c939e-34ea-4bf2-97a0-f8bf000f27de", "comment": "Malware payload (GuLoader)", "value": "4035c215b18b2c043034df41cea9a2a15f490611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750645, "uuid": "964bd030-0563-42d6-960a-47a35a2993ee", "comment": "Malware payload (GuLoader)", "value": "533a8d3f3cb34b8bcda096e982df46103e4bcddc274a46f7a8ab495624285cf70b75669112e4c68a3975d6e4e058ba68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750645, "uuid": "fff085f1-d893-440e-9452-adacf4a2d297", "value": "T13CE41282761B94C6CB73857218277F8A46656D3CB3502F8323F7B3346A73232D15E26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750645, "uuid": "455a7f6b-ea0f-43af-b68b-8f79e7c0045e", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750645, "uuid": "ccaf4f7a-588b-4a0b-9987-09d05cbbea18", "value": "12288:3c2zv7rddKq8kpMMMq3vh+f7fAKAmJjHsmgHEDDAVeb9a2k5h8HF:Jv9coMMMq3vh+f7F9JImxvAMu5hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750645, "uuid": "a5d0cff9-4012-4f63-87b4-83d976b4cdfd", "value": 671432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750645, "uuid": "e8b8d073-e4dd-4b59-8362-5c76b13fd77d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750645, "uuid": "ed839590-b547-48d5-9006-570714f71965", "value": "Fattura-372_2025-servcomsrl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bbcc87-d020-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764749804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749804, "uuid": "402f7175-9a44-4640-beb4-67f5d19b0391", "comment": "Malware payload (Mirai)", "value": "001334445b3709131c5cf331ba16479b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749804, "uuid": "40f13fe6-272b-437f-bdc5-9b7789c77e57", "comment": "Malware payload (Mirai)", "value": "ace32e96562485d09034c5b8d4dda859e5705092c467d5ffdb9b5296343431f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749804, "uuid": "93c0a1d4-46a5-40ea-bbe0-db65ad6676fd", "comment": "Malware payload (Mirai)", "value": "ffc652fc6766661ab6f76eeacee2d231e41b14c0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749804, "uuid": "b75e82c7-5220-4338-820d-5e469a2c068a", "comment": "Malware payload (Mirai)", "value": "2e08881061d9e8be1635e395819c23fedfbd14f545b32ce2584a66fc43bdfe8c2e311fe652393bb1406e449e1aa3d358", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749804, "uuid": "f6ee191b-40fa-4ffe-84ea-7f36a9bc3ba5", "value": "T1715130CB15CA97F0DDA599D171F948046CC2F697A4D3DE42E9E824A88C8ED8072D1EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749804, "uuid": "38a378ea-7956-4725-be0e-29c841f9993e", "value": "12:q0F2ZkNPhFKX0F2wkB7hFKX0F2oiko4fhFKX0F2RkthFKX0F2QLkQ2hVDhFKX0F8:vdUrtU8lYhh7qeoU5VxKNKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749804, "uuid": "34c16df9-19d0-461f-99e6-6db8ffab3fb4", "value": 2685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749804, "uuid": "45aa52a3-0269-4e2a-abf1-a9bd7e5a9163", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749804, "uuid": "e1bd8b7d-c250-4252-90b6-ddc1e50bc040", "value": "zte", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eac994-d069-11f0-a129-42010a9c0007", "comment": "Malware payload (VanillaRAT)", "timestamp": 1764781396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781396, "uuid": "036ca7d3-3a9f-4128-9109-f3704fab5891", "comment": "Malware payload (VanillaRAT)", "value": "f83b90e59368c101beddcd519d540d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781396, "uuid": "cfc862ef-6ac7-4f20-9133-8870c7dca8e3", "comment": "Malware payload (VanillaRAT)", "value": "acee1954a28c44d1353b5d05026d0de8bfc32e8b76c0a0ed1a057e9f6490e779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781396, "uuid": "363d0403-c0f8-4cac-ba90-105bfc123c63", "comment": "Malware payload (VanillaRAT)", "value": "448a7ed5758957656a9330303f33d25a38c47ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781396, "uuid": "4e74ee7d-5c87-4bc3-8d5c-99e3baec835c", "comment": "Malware payload (VanillaRAT)", "value": "c0f41e4c8c3b1eaac0c871921697e4a65d8d4f53e8afc4fd6ad0ffd9b5f351b2dcfe5fd3dceabbc2103c098b68e1fb1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781396, "uuid": "0be4edc4-1b71-42c8-9220-0a62df780889", "value": "T13AB37D1D67E8CE65D9BD5BBBF83611101730F1422823DB5E8A84D4ED2E63BC18B167A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781396, "uuid": "b88fb860-1a11-48ea-82c6-4706dea7a71f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781396, "uuid": "26f97a5a-f7d2-465f-8367-a47dcb83d102", "value": "3072:4gZApdYrD28fbJB2yLtyTgbjjxK3QdjrxivW+DXnH4vymbc1v:4/pe1J0gbXtrxivW+D34v6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764781396, "uuid": "f72c4253-4457-4d43-968e-689572ead238", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764781396, "uuid": "e3f45a58-c415-4870-bd96-ff7b067aabb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781396, "uuid": "1a177a58-78d8-481d-848a-1cc1a0c0a70e", "value": "f8bet-gr-com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c8a72e-d037-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764759595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764759595, "uuid": "cedc3b50-492e-427e-b229-f1c04c2f2da7", "comment": "Malware payload", "value": "b3fc0a455aa74cf0b3756f0d9a36d4ae", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764759595, "uuid": "0a64820b-1df7-4b55-b61d-e356bb66d68d", "comment": "Malware payload", "value": "ad334976d8acfb3eebd1e23f72a2fd3e75951f89709f23ddf520b62ca12753ab", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764759595, "uuid": "6b6afb0a-691b-4499-9cc3-7e828cc8c505", "comment": "Malware payload", "value": "9694f8bae075433e89adb16d1d78066c43889f80", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764759595, "uuid": "7c09c7d2-c84f-4778-aa17-51e4f93653d3", "comment": "Malware payload", "value": "fbebf4c84ee15f777cb374e250aee6b5ea9fb8a521ca8790635239d5bfd35086131d237bd38728844a4c96b0d3226d3e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764759595, "uuid": "371d76e6-3528-46ad-bdd6-e5493f7d659f", "value": "T1907384583BCB84FCA627B8D489CF8C02EBE48913561CD6E1BF9DB5942F2553861F49E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764759595, "uuid": "779fc670-23f9-433c-a7ae-0c7cae1af48d", "value": "768:84u+6BDzsU/ZH1DaMpHHFmmoNsuG8/g/zsVaNDGN6dB0jFn3+1R7oAwI5d5ukYty:Knpmzi38/gbbp5TYtX3BpzJ8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764759595, "uuid": "f7eaff9d-b064-4437-af33-cf41d9f84c8a", "value": 76236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764759595, "uuid": "9550150d-e4d9-4cc8-83ad-bf4503b0c55e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764759595, "uuid": "cd8312f5-99fc-4fb0-9072-b10436bf90d0", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0496f44a-d042-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764764241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764241, "uuid": "28652fa3-c4a1-42ab-9749-8aeb53f6fd48", "comment": "Malware payload (Mirai)", "value": "1b2e1e6b2eafdce76ead1db9394e9e2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764241, "uuid": "075af40b-3779-490e-98a7-67dd3cc0d3b1", "comment": "Malware payload (Mirai)", "value": "adb69f85ef996ebc42d444d9eb6e076cece6af36558421be228669b0e2edd989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764241, "uuid": "a13916d9-7288-4d2d-80e2-ecd22d70d0a2", "comment": "Malware payload (Mirai)", "value": "9a5ac2c68a4e01efe0d228d0b374c19708218e37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764241, "uuid": "72df198c-081b-4dfc-b6b3-95e798a5b1d6", "comment": "Malware payload (Mirai)", "value": "c0577f610aba086b38361c7a477b23ab3026e5faae57cb5a5c898fcf0a2233c1f6e52e9afdf34801b9ca683ec3efb232", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764241, "uuid": "07087014-4cae-4ff1-a779-8e59aa80eadc", "value": "T1C0C33C46BD91CA22CAD522BBFB2E118C332613ECD2EB71039D245B7836CA55F1E37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764241, "uuid": "255edaf8-f93e-45bd-9387-8aae2354d5e2", "value": "3072:32ad5klmZfkE9UMArBapTED5vyPE1RB87ny:V5GgUX4uRBqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764241, "uuid": "28c93b03-f8fe-4d2d-84aa-6f473899345e", "value": 128600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764241, "uuid": "50c16e7e-11b8-4c4a-82b2-c47414d6d3fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764241, "uuid": "69d45ed3-1570-4e46-80e2-3277e422a836", "value": "Yboats.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89a1819-d000-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736276, "uuid": "cb637fc0-86ec-4dd2-a629-8a7edee3c8ad", "comment": "Malware payload (Mirai)", "value": "71344f7c21d4a74f4b93db3ddc3c7ebb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736276, "uuid": "b54dec47-b958-43ba-a3cf-b6543cd34a13", "comment": "Malware payload (Mirai)", "value": "adc9e93d5f38ae028ea783883fd0caaf8eb29ae582d5a04d115bf1048229997b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736276, "uuid": "427330e1-e873-461a-b280-c708059b00f0", "comment": "Malware payload (Mirai)", "value": "e46152a909a9db24a88241624d5256abdc9203dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736276, "uuid": "1d891ac1-eb4c-4dd1-af3b-2e343824b32f", "comment": "Malware payload (Mirai)", "value": "94741898e024e435007c10e8e33d1f774f9f0897a3718e6c1132cbabfb06490aaa4d53dd844af147d6972259108f55c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736276, "uuid": "aef25e5c-c7c3-44f5-b8e8-f35170ead865", "value": "T11E246C96F643E5F5DC020970106FAF325E72A93BA237DE82E7ADD531DC16601C21B6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736276, "uuid": "06de8648-9364-40f2-864b-98bc3b934969", "value": "6144:tb7Ns7i2EYN4z8vvUdaNJaV7mZ3ADJe4EFq:tNs7i2EmBvvUdaNEVw41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736276, "uuid": "2893af9a-bea1-4352-9b88-9bb472056e06", "value": 215656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736276, "uuid": "e93552ec-8bd8-4664-917b-e9f5936cb6d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736276, "uuid": "22637d6a-da47-48cb-acd2-2c790e2c926d", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25fa054-d079-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764788155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788155, "uuid": "8ae9354c-5af7-465f-9988-2b2fb3eeb234", "comment": "Malware payload", "value": "fc612e51e23ffa13d1915b82d08b5ad2", "object_relation": "md5", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788155, "uuid": "1601d1af-af44-4720-a294-4f55c6ed59e1", "comment": "Malware payload", "value": "ae09a1dbdbc41e7106eddc955d3bc7b2a68af22946eb310c209095ac92f5f7e4", "object_relation": "sha256", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788155, "uuid": "d10db44c-2d82-48fe-ac54-d11b00c78690", "comment": "Malware payload", "value": "b2799cba6ef427641345e9bb80450f399c09bf22", "object_relation": "sha1", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788155, "uuid": "cf59e705-118f-4a6f-b8a8-acf0d0aec49a", "comment": "Malware payload", "value": "c3aa7544941162c958e8e1c2abdd3f5d7be47f46aeb6b609d4989b7f075e6f8e2d4880ee2e185aff221cff83f5a29119", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788155, "uuid": "3673bd10-94bf-4849-a7ee-4adaae3a1ad7", "value": "T1FD72A8F864CFA96B68B552539D649D3AE29A6E431114B20F3DFCD2500FF5A92F34083B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788155, "uuid": "9df686d8-783c-4670-a9f2-a785e7c1ef53", "value": "192:oja0R3001RTSvqNLxq+BLKSyhjM4Bu7f/ROCVLD6S+:oe0XReiNLxq+B+Syhw4Bu7nHVLud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788155, "uuid": "4dbf6767-10b6-4ade-83da-1a44e96a2fbe", "value": 16601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788155, "uuid": "fadb9b07-99d9-49ee-93d9-25e8b448d503", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788155, "uuid": "01987bb2-a975-4bbf-8366-c374ac3c7572", "value": "aliases.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44b4690-cffe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735437, "uuid": "b2cac3c6-bfd2-409a-b8d4-f884fc80c317", "comment": "Malware payload (Mirai)", "value": "d9c87aad3e6deea9085c0efcce3ffed0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735437, "uuid": "437ce126-10a4-4258-8c9c-933c3fe41fe3", "comment": "Malware payload (Mirai)", "value": "ae4d1d68949c0e44a5565f4eefdebee9b5c792b5517987d11a6f25870981c21c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735437, "uuid": "53a04364-059f-456d-a22a-252b551036a0", "comment": "Malware payload (Mirai)", "value": "4f891ae1409a6710832664126a1daf38e587d94e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735437, "uuid": "68e17ee6-5cab-45a8-a81e-0ef0a4413f1a", "comment": "Malware payload (Mirai)", "value": "ac0711f645ba3dddfaf9614304d223d1b66bfa599738d2284595cbec90b118e7ac67f2f1e18cc0aeff8df6cc62a120a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735437, "uuid": "2fe17b55-3983-47b0-9070-6d4876702486", "value": "T138932856FC818A25D9C506BAFA1E118E3313177CE2DE72239D149F2077CAA2F0E7B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735437, "uuid": "16a30e01-e5c7-4a1e-8124-82a4fb52037c", "value": "1536:7fn2ypqoz5mE6hNjLqLGisvFTvhfvE5YuHralPxL2OUJiCsugqfYRm:qycDFh1MGPTHECuHralSslqfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735437, "uuid": "4616b868-d7ea-4491-911a-c1a1ca3c4b7c", "value": 95888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735437, "uuid": "f46cb4c7-8c9e-4fa9-abb7-41077cce5d56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735437, "uuid": "05893526-1f6f-4d4f-8cdd-d90a9935db02", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7c6973-d04e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764769460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769460, "uuid": "5a80d052-f277-460d-9585-d84954d8f7b0", "comment": "Malware payload", "value": "8268c8d4b2eae7d4160b242aed56f2d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769460, "uuid": "ed648477-b779-4694-a273-09e4a5ede6ea", "comment": "Malware payload", "value": "ae57c71d1fbfb3b66924c1453dd7261efaa56d9d456233fdef94aea1be1b0002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769460, "uuid": "f0c89366-73cd-420b-988a-ab1e84cc7e71", "comment": "Malware payload", "value": "19c42fe66bc6b132afe2f7af774f3518652fbd68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769460, "uuid": "579eaad1-7f2d-4adc-8d63-b1164967d4c1", "comment": "Malware payload", "value": "8ab314e122e383047baf08b15e3f4a4f86e4be02480365ba76addc301a7c1ee62e1132820b72be787025efa8a3a90144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769460, "uuid": "a95cc7ea-d992-43c1-aaa8-fd2b6a7f7b9f", "value": "T133C63301F79284FDD169D0B4C2454676AE72BD8A0329B7EF12A09A343F75BE26F39740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769460, "uuid": "770b3b3b-0dd8-43e2-8a76-d653ad2d12b6", "value": "b6902755f55a9374b81400c2614e4f0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769460, "uuid": "d6518f80-708f-4e99-b586-a150e533334e", "value": "196608:aDXdH/ZuO8uXoSCxGMvDoDwOC37/thTAWQhCGssCWyCACets4j:INfZykWGMMDw9hT/QkGsPWPAnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769460, "uuid": "56eff3cb-dc52-4110-a166-03329cce43db", "value": 12378696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769460, "uuid": "f2024676-dfcc-4538-9422-b0b3615f6db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769460, "uuid": "de71827f-15ed-4d5e-aebc-7e51e2895907", "value": "SolaraExecutor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f801c4c-d008-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739402, "uuid": "1595dedc-e809-48b5-bbd5-6e4ea3059795", "comment": "Malware payload (Mirai)", "value": "9748a8f6ffff76093c5c92a3dc39c76f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739402, "uuid": "3f84adc3-62e6-4e52-aca8-06580b60348c", "comment": "Malware payload (Mirai)", "value": "ae8c547ece5a434f8b852aed2d926baf9d3a3ef1e729757e82e63408d96f2cba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739402, "uuid": "257c800b-2fe2-463b-8de4-56b8a93d13f4", "comment": "Malware payload (Mirai)", "value": "09520107d5c7b1903f0bf402086232374064ee29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739402, "uuid": "50648a2f-c19e-44bb-b04b-84cb3075bca6", "comment": "Malware payload (Mirai)", "value": "0998eb5ab7f9b11bc4a9e7f79cccdfcf5b05ba4df42d7c351c5bcd8dd6a839d72d58379404a77c7fac4fb0eafb6f5d7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739402, "uuid": "bd6f9c5a-04a7-49f3-879d-bf3b233d58f1", "value": "T1DE24085DE4508B3AC7C1227BF799428D33335F68EBEA730589256B343BD66259E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739402, "uuid": "5ff47028-358a-4a8a-b89b-c1dae407619b", "value": "6144:LiBl1JNmBHPp8XCZUzUkUwOvyibrmrcwdm7eb:sBNmBHP+TU3nXm67eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739402, "uuid": "0d6821f4-4254-44cf-912b-972ebd9c0452", "value": 209764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739402, "uuid": "4390c021-b39f-44e1-9113-f9db35f67942", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739402, "uuid": "80b8763f-213c-4ef7-9da4-0c0e6d068aa1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5f8ccd-d025-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1764751964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751964, "uuid": "b9fbe302-f656-4c3d-bd6a-af8703a996d3", "comment": "Malware payload (PhantomStealer)", "value": "0c10dd17b5bab4da95d9453576bcee26", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751964, "uuid": "778092c2-62ad-4c98-a2c1-728bb8cebce5", "comment": "Malware payload (PhantomStealer)", "value": "ae9ed665067aba1f5d0c909dc73a1d88296798388c58639a3c844cdcb3417fe2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751964, "uuid": "78b3e729-5a19-40de-bb79-faee2fcf6f8c", "comment": "Malware payload (PhantomStealer)", "value": "a45229037d303ef0ec7747e91dbc6dc0b04c88eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751964, "uuid": "15cb17dd-25ac-40c9-a964-a71870ec4f34", "comment": "Malware payload (PhantomStealer)", "value": "59415afb073b006fa9c42012785703943f1aae505a49b8bd76b7df5a5c4b0ad231678b6b9eb5c7167d0d9cf717a12c8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751964, "uuid": "e8b9d87c-32c9-4c4a-9f0d-93504cce063d", "value": "T10D8612A597793DC94EB24213EF8E0985E8B72B9F6C187C7DF62D61C04FB11E520588E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751964, "uuid": "81a10bb6-a47f-495e-95c4-d3dba4c0f619", "value": "384:HrS+iOrVAK33hwASlhPKNhlKgFhGy10Yne+iKWtW2aWNK6CKJGDp+j5B/71zyMMB:Hp6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764751964, "uuid": "1ce99c1c-1e9c-465b-a3d9-29e07b2c2d5a", "value": 8122004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764751964, "uuid": "535b25ed-12f3-4bc6-a1a9-25e159264839", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751964, "uuid": "d0f97aaa-9045-4280-bc4a-3a7a23baf3db", "value": "arquivo_20251202080958.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a40f25-cffe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735137, "uuid": "cb9ed361-ef46-4e71-ab20-eaf00439930b", "comment": "Malware payload (Mirai)", "value": "1a61e4401fdbc4faeeb998dfc0788689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735137, "uuid": "c7738fc2-64b4-4c7d-a773-560cb158cad5", "comment": "Malware payload (Mirai)", "value": "af1dd3723da4b25d3ecfa01bc8317c99f65fed17ada77f844348f116278c63bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735137, "uuid": "89165a76-56ea-49fd-aa8c-59d31854e370", "comment": "Malware payload (Mirai)", "value": "7a3a811a8144749bfab0b5c1fa4dc36d03750c20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735137, "uuid": "226f02ca-3165-404d-8426-46ee294dcaff", "comment": "Malware payload (Mirai)", "value": "7bc9058a689c97d0ab36ea2e56e413fc0fc6cfce0e289910f6edd05c6c6b869182f0ba774a91a0281dd7ff9f08f4368c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735137, "uuid": "1ae3909f-8b16-4fc4-910c-a87a5d2bac9e", "value": "T1B8737CC6AA87C4F4FC1655723177FB3286B7E53E1019EA43C369A936EC12942D21B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735137, "uuid": "5c02aac5-d9a0-4680-a89a-17056a8be71f", "value": "1536:98JfkqLRaEogPNU+9alv++gwy4YqdZhW0sSmXJY:SJfzvvFN9alWGy4dfnszY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735137, "uuid": "a7663b2f-8e84-4613-8ed1-98ad066fc5b4", "value": 75632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735137, "uuid": "1d3b4cc8-3994-4b0e-a7f2-9d39ecb93914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735137, "uuid": "2ce83bbe-48ca-45c0-bf37-6e2da2f616c3", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba6bf11-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764770078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770078, "uuid": "410ee6b4-76cd-46f6-a80a-a1fbf84efccf", "comment": "Malware payload (SalatStealer)", "value": "7dccd36d018141480997bd88fa7d8e26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770078, "uuid": "153d7ebf-2b59-4111-8eea-22ced8f0c925", "comment": "Malware payload (SalatStealer)", "value": "af3296ecfaa277da4c620ed311ef9ea485aa9ef2c0c55ef2c9789e8aacdcd0db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770078, "uuid": "bde598c8-c779-4a4f-9042-d45fe486a2a2", "comment": "Malware payload (SalatStealer)", "value": "017b67d96bd20e334a5038b91cee9535e55abc6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770078, "uuid": "8e352826-77f9-4404-aad6-e50180007c62", "comment": "Malware payload (SalatStealer)", "value": "9fb36c158538b92ab3c2d23a9beb92df60f902a701745adae66289a07fad5eb86b31d1d3fecda0744de5038f44ad05e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770078, "uuid": "08cfeb29-4ea3-44ef-9959-202565b5b0fe", "value": "T18AC66B41FA8B54FAE9031835805BB23F63355D048B29DBDBEB543B6EFC77681193A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770078, "uuid": "f0179a5d-0f34-42bc-b3e2-e2e4adedd688", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770078, "uuid": "8e9ddfad-45d1-4c2a-958c-be98ab429c04", "value": "49152:gA/ymxVZNTi9UJwLHv+77rR0svsOfKI5LpRRYYubNmN2j5IGZhcGg7g7683l88Xu:5KmvZ1yLHq7ri0ubVvkpCp2+PZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770078, "uuid": "13d217f2-0941-4b69-84d1-f40bc30483df", "value": 11659776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770078, "uuid": "38a4e686-7ce6-4c80-85f8-0f7efe822cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770078, "uuid": "7f451e7b-026f-4edf-9c03-046118cd3231", "value": "61a637f731b2d38450c99cf350414aff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89408ef0-d046-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764766181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766181, "uuid": "aa5a08b7-a05e-4de4-bf3e-e8a9a1f30bf9", "comment": "Malware payload (AgentTesla)", "value": "61f90c42117273952c24885f5db8ce4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766181, "uuid": "5e5a26aa-f75d-4c26-96e8-1c02fc9e6a1b", "comment": "Malware payload (AgentTesla)", "value": "af48c1ccc7264156dfb8e35fc36cad7ace7d531eadeddf53be927c9c3c7324a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766181, "uuid": "03918206-1f57-4f29-9437-296de02d0bbe", "comment": "Malware payload (AgentTesla)", "value": "ee9f9eb19d8eb99df19a59ed1a7a1831bf2351b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766181, "uuid": "cb80aa22-6773-4aae-894a-2f407891629e", "comment": "Malware payload (AgentTesla)", "value": "241c90343ddf013eecb4705bce8c2ee508bc486ee048eb20753dbc46c41214e679da7a6fb97170df50adbfae3e34181c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766181, "uuid": "f970c549-14fe-4551-aed7-4815dd76ddd7", "value": "T17D95D037B122CB6CD0CBC9B824E396F21D307E241AB5124656CE1B5F2AB3D906D5D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766181, "uuid": "0390b1fa-a4b1-4fd4-b8c4-a0815aee3bba", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766181, "uuid": "ff135e8c-6f0e-45a9-8555-7d1908ea7ba5", "value": "24576:8fs4r7YFz75ELy9vS9/aOHR+Sf3TstbokJMxqavDzWLyvt487diDxa/+0A:+sa7anKy1S9/aOHRnPTUod1vDSLyh7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764766181, "uuid": "e614a868-8886-4c25-97f7-3a4d97ac8144", "value": 2035648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764766181, "uuid": "49c92912-6484-41bc-92a5-3e3a16f0003a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766181, "uuid": "07dfd141-3a0d-4b3e-96f9-c68ffabc963f", "value": "temp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fbf61c-d05c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764775460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775460, "uuid": "cfade2f7-e5be-41fa-84a2-941659f78348", "comment": "Malware payload", "value": "2302ac285a72a5d7a0c6386232e994fc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775460, "uuid": "55a6bd0c-81fd-433f-9a90-12ea0ee1f896", "comment": "Malware payload", "value": "afcaeb77da3454a60276d18bc69d16e167bf6064573611ddc9c6b856702c71c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775460, "uuid": "947e2b99-9fb0-41b8-a05d-0f18934ea0bb", "comment": "Malware payload", "value": "2c5993370d69f601a9ca1fc405f255b8ee9f1f6d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775460, "uuid": "b97982f4-fdc5-42f3-b88b-5dbcd3dcdd14", "comment": "Malware payload", "value": "6adba4cd955c3834cb7cc2c0288dc108bd28f0dfd102024227ba6e7c8ff5d0d50a9f67c45c55be51316a7790a02c550a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775460, "uuid": "6727a7e0-00be-4665-a99b-5bb7298417cd", "value": "T11103625263847B58224B5FA3671FF0F7EE4ABAD830950CCBD0247C88A7A1539DBD6934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775460, "uuid": "eabe4d85-3afc-4de8-98a9-9113b22c7d6d", "value": "768:4aLDi0OBs3PPDKitJf/jJUcT0jyMC4raXcdtL7Jtw45ltrdQLHsAivd4DqDneOF5:JPOZD+sDEIkAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764775460, "uuid": "81b4dcf9-1903-4656-9d0c-68e84229c92c", "value": 40311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764775460, "uuid": "aae68155-03cb-4876-a0d4-f2b4d8edfa47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775460, "uuid": "24deb827-c4cd-454f-ae39-0e9c5c93c9be", "value": "Ekumun0ibowofa7feyi8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10c60d5-d089-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764795051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795051, "uuid": "8e6d76f3-d416-4b44-8d4d-d0d773ce6377", "comment": "Malware payload (Mirai)", "value": "44b8938cf69ec3e000952a9818bdcd0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795051, "uuid": "e365b46a-cf08-433c-b58e-59f8f6dd5ba3", "comment": "Malware payload (Mirai)", "value": "b091565017a25dcf10d268b22b2a323ba3a0ebeb3d8f9aba8f23af6a06a4e3f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795051, "uuid": "c748ad6f-fb6a-4cee-a5df-211d5ddfc0f6", "comment": "Malware payload (Mirai)", "value": "4914cf024fbc05ef8d4f1efd1bbb0ad68d907d0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795051, "uuid": "30c9a4bc-fd51-44e2-9f42-08af948ebdd6", "comment": "Malware payload (Mirai)", "value": "6b7773a79b5377219ec8f5ddd4638dfbaefe6c6b37f8778785f0f18a3aebada3e70a99c1ffe4b44bc8994b7821b7760e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795051, "uuid": "160a8d14-cd76-4d50-a492-267385f657ef", "value": "T1ECD39D8BF78B04A0C86306F007CB0B9E6EA321D15E5BD9E37D29A63B5E754DB0905BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795051, "uuid": "6b96022b-92e2-4017-9c50-8a9d42437eb3", "value": "1536:cNPl84Yxdno7UIc/dfzGm4GPOhaHwoVc56cNlO1ZFAx6RRgsKx+/LWB:wl8HW73Ifam4IWaQ6c56goZF9gsE+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764795051, "uuid": "3b0410f1-81cd-4137-9f25-ea40fb5b72cb", "value": 132688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764795051, "uuid": "e709a6c4-d319-4355-b9e4-922488489ff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795051, "uuid": "6edbfb58-26ec-4c3e-9a26-c81eb563eef3", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef817df-d07d-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764789652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789652, "uuid": "f7e7e72f-85dd-4132-ae4b-585337990633", "comment": "Malware payload (ACRStealer)", "value": "de6ee696a75b07fe1d331227c7ab78fe", "object_relation": "md5", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789652, "uuid": "dd5d9602-dd6d-4d99-a3a7-32369136b38a", "comment": "Malware payload (ACRStealer)", "value": "b126af50b8713b37e4c1c6c0ee88aa5eba5f0047f10f9ee1f351385f26e6629f", "object_relation": "sha256", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789652, "uuid": "59cff322-0a14-4501-8f63-f3a57dd05af3", "comment": "Malware payload (ACRStealer)", "value": "d8d4f68a923f075e95f70abe8abcc4d5016e2980", "object_relation": "sha1", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789652, "uuid": "d1e4532b-aa3e-482f-890c-6fb648d62baf", "comment": "Malware payload (ACRStealer)", "value": "eac38e3e1250e585173173adceabf5a98bbad7a8ac8524367c8afe1e5dfc93edc6f34140ae0ac8aa7240b6dd7a90b248", "object_relation": "sha3-384", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789652, "uuid": "875d2a69-b67e-4b0b-851e-080ecf0f7dac", "value": "T1F2A66B10A8C82607FD7ADFBC999E72500F7AB1962541BB388F5149D93ED1B68C8139F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789652, "uuid": "ef2aa5fa-99f3-4e9f-8c53-cd5f176c1d2f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789652, "uuid": "989094b6-c0a4-4440-bb94-428f7aad3561", "value": "196608:Tp2AsCUw1aaOwi4Jv6yE7NIxKGFSuRaYF7gsKg1:1bUwUaQyo7IT7BxKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789652, "uuid": "884cf938-970c-483d-b3cd-0052848e9e4a", "value": 9918976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789652, "uuid": "31d427f0-ccfd-4f2c-963b-65729e10cc2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789652, "uuid": "491257e2-4bd0-49d6-aef8-6716b5bc347f", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd432030-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764782187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782187, "uuid": "e27ef885-70f2-45a0-9369-38a4a53e5b75", "comment": "Malware payload", "value": "a740e1384ba8bbad8da032c3d9757e03", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782187, "uuid": "dc923263-5e7f-40a2-b84a-d1daf95a5902", "comment": "Malware payload", "value": "b17345e47292cd634489df6bcb0ae469986310ee28fcdc187c522fcc6d96136d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782187, "uuid": "5851c49b-6720-46cb-a4c9-32cce2442091", "comment": "Malware payload", "value": "0bae8034339644c311a2565c6091bb441e14a05d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782187, "uuid": "8e89d4dc-c8fe-4913-801a-dd5f91ee6e14", "comment": "Malware payload", "value": "33c3ac40246da9813154e30acec4ba85b59202b92711a3b6ee9a5a553b7ddea5854919ccd36f12660fa0af89210c8cdd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782187, "uuid": "1d922745-3ba3-42f1-b099-e0276f4cb7d5", "value": "T16A31BB173D18FA25C88F4F5812718352FDB2605FB600E8AAE076D3662620BD197EF446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782187, "uuid": "8eeb6f49-756b-49b1-b455-03f38afbffe0", "value": "48:W2sqkecWqN6LJ0SWW7f+bBIyF5KlWlrIIy65Cb4uvV:fkeE2J+byB4BaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764782187, "uuid": "ce12eeeb-a913-4174-b038-face5179277a", "value": 1789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764782187, "uuid": "49dd07d4-9bff-49be-8a76-d7efc6ed79e9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782187, "uuid": "fe8af844-d8ed-44c7-ad9e-cf305ace57d7", "value": "zoomplugin_update_V16.8.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08907a48-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806338, "uuid": "91d64535-3252-4c23-913b-56945098e41d", "comment": "Malware payload (Mirai)", "value": "6a6fbfbbe597c8fa719ae1dd19d39ebd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806338, "uuid": "3748a13e-b64d-4877-95b4-c99b82ccde47", "comment": "Malware payload (Mirai)", "value": "b1eccaad4aab582b888afd3ff0964c870aa22c01c6c848a5402f42f7461eee7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806338, "uuid": "a65eaeb7-bccd-4d23-a468-67d78fe6302b", "comment": "Malware payload (Mirai)", "value": "cb48312ef5410669d5d176f39b93d2028fa18fdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806338, "uuid": "a2d9496a-835d-4785-a6dd-7e923f3ad229", "comment": "Malware payload (Mirai)", "value": "b27852ad9564afffb238a5c36c612c5d93429ff8b621ddcdf8a1a893677230bb3857c0cfa6fc5c38727217f7be8d9309", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806338, "uuid": "d9cffd39-8a9d-4e20-9400-09b082f512ee", "value": "T141939E66C9745CA4C66845F4FCE0CE758723A814A2E3AEF252A7C6769087FDCF809374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806338, "uuid": "14a1004d-7884-4b12-a9a8-0ac42e01451e", "value": "1536:p/AhDria+4iBXWpCPdpuKCAay7PsOCZCyVnMwXbXB:pYhDODXyCdpBCyAOCZTMWbXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806338, "uuid": "eefa4c44-0405-4afc-9a9b-947b61a9fe30", "value": 91732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806338, "uuid": "a6283cf9-6d58-4af8-950b-346f521d2180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806338, "uuid": "507361fa-60cb-41ee-a6f3-24ba2393916b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e399a7-d09f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764804262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804262, "uuid": "ca6427b7-5fd5-4986-a75b-99e5e7a1cf86", "comment": "Malware payload (Mirai)", "value": "f6491650b03962fbb7e52e69dcab78af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804262, "uuid": "14d4c8bc-07d2-4fd9-b016-867d08fd482a", "comment": "Malware payload (Mirai)", "value": "b2aa9f2c59c5ae6d96906e5c0ab09ff79747751ac80c3f78b97e78a69ace7bb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804262, "uuid": "c92fbcf4-9f8e-40d7-8c2a-2c05fdda0c84", "comment": "Malware payload (Mirai)", "value": "7d65e2630eba3d38d0a4dff6fb09acab9d7058d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804262, "uuid": "b3000528-a0f6-45a9-887a-4e0848e566f5", "comment": "Malware payload (Mirai)", "value": "453d77ca2eec4955a505d5081db1e6c830a60aa557f007e589ab42d889d29cffe20f15299c5cf4b9683f7c9af7e8fc86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804262, "uuid": "96330283-f802-4428-a057-64db8c875eef", "value": "T1A2C33A41BC828A63D6C71376FA6E11CE371163E8E3DE7203CE259F113786A1B0D6BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804262, "uuid": "ee711b8d-22d2-449a-b157-2ee33afe16df", "value": "1536:OKmFkAOKL8lbRUysUncuRbiJB+L35iOEGnacQ9LHxdEY+AqgCvA5xve:OKmFkKLmgc5iZVcQFxdkXjAXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764804262, "uuid": "20fbb038-4581-4aa0-b1ae-91cb5fff213b", "value": 121376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764804262, "uuid": "6a59500b-5ba4-4699-ab64-b29e899e0d63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804262, "uuid": "98ca8fae-7ab2-4696-b680-3f751673ec68", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd33084d-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764770134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770134, "uuid": "3edbf5b9-691a-4d23-802a-af4a34c06c41", "comment": "Malware payload (RemcosRAT)", "value": "17faa242e9cee0add62999f2cc7c08e9", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770134, "uuid": "af52a47d-4a5b-440f-b158-93873688a68b", "comment": "Malware payload (RemcosRAT)", "value": "b3bb0f051096210a71a558cd6d24f577e5e8b2066a99ffebb8ed5f71d1e9e888", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770134, "uuid": "67e20974-67dd-4d88-afa4-486ffa1df6b2", "comment": "Malware payload (RemcosRAT)", "value": "b6673eea4cb4fe013bef444b5d518bcc66cb73e9", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770134, "uuid": "f4781e80-0d5d-4216-8a1f-c76eac063d12", "comment": "Malware payload (RemcosRAT)", "value": "4ec6d6ad3e4b07c4eab027811fe86c380e1723d21be629d71d1a60497e8782a852ffb1d08a024b44e3d80dc54b5e975a", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770134, "uuid": "df4b05b2-da65-497b-8b9f-ce21506be8dc", "value": "T13B66C75914E810A3D5667DF69F3E6E608C0E2E1324D22C1B342A7E9F34ADD99D620D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770134, "uuid": "2635bb1e-3f57-493e-bfcf-9add7aa51982", "value": "49152:01zb4VCQMoWxjrYUkAJ7XhEBA2tbK7LZ5+bWr4cs4aVBsqLK/P9IgfY6+Jon2AlX:EF5J7XhEBAWbKf0es/gNYUlTB6ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770134, "uuid": "98dc3ec7-536c-4599-af3c-bc6b0da5e229", "value": 6562633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770134, "uuid": "03fc646c-a57b-46af-94f4-764fe02b490f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770134, "uuid": "576c23a5-e94c-42b8-bdf6-b3189b5bdd07", "value": "HSBC Bank_ Payment Swift MT103_Copy.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aa8026-d052-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764771242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771242, "uuid": "548ef96a-2cc6-4c94-9e12-8f07feb216e3", "comment": "Malware payload", "value": "0065c0a537222174cec697a13f305158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771242, "uuid": "dde69951-2538-4fad-ab04-515e8f31d551", "comment": "Malware payload", "value": "b4016039bc3d533659cc7367c260cc2545f620288284d403b75e0095fa4ea0cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771242, "uuid": "2a236636-de57-432e-b2a0-5ba080df28cf", "comment": "Malware payload", "value": "0e19356d086adb4963dc283eb21036299bb1bd92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771242, "uuid": "df17c73e-96e2-44fa-a60d-fad3152e53f8", "comment": "Malware payload", "value": "eb47b0a7316d48473e5e674c1cb891c7f979ad336e2d3e4c5492577e95ac360e1dfe5164ccb0c23acfa5780d132deea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771242, "uuid": "86190f4b-97d1-438d-8b06-19e16b626ba1", "value": "T1B0B412914EB580DCDEFDF4B0A5F4B126A1B96455CEF383F60E6E6818DB405AC8037AB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771242, "uuid": "9c36bd74-2d4a-4971-9975-043144b05e0e", "value": "52d5086abc1dabd2119b92104f1111a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771242, "uuid": "e3adb7c3-6fcc-4c7a-847a-00d00fc5eccd", "value": "12288:unmjgBKsNhGyOHTnki13D+HSnP8s6WKN1hcs6LMylZBhRg1b5ELdnRpVQ:vv8hGLnb3D+HA8BN1hc9MjEdjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764771242, "uuid": "6bd9a7c9-7b75-4b34-919e-8632c059ca30", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764771242, "uuid": "d9e2f729-f3ca-4eb9-ac5a-12165f70ef1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771242, "uuid": "89efdd27-6a13-4b62-b56a-fa7640648f5b", "value": "0065c0a537222174cec697a13f305158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7edb0c1-d04e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764769803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769803, "uuid": "9e7333ca-c920-435a-bbda-a8c0cc6c1793", "comment": "Malware payload (AgentTesla)", "value": "1d5ef619ebda611a1ae7211164ec1328", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769803, "uuid": "51f3e87b-83b8-40b2-8d9c-c94567356f0a", "comment": "Malware payload (AgentTesla)", "value": "b529cef98058b9944f2655530e6ed5599163c96b76da36150e7c7247e956e373", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769803, "uuid": "7373fc5e-9411-4b5e-b58b-4501c1035f94", "comment": "Malware payload (AgentTesla)", "value": "af814b23d15ba66fdcb6d1f916471d4bb1e17b4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769803, "uuid": "c8d69340-8811-47b0-a257-2ffcfb76f534", "comment": "Malware payload (AgentTesla)", "value": "c99a93e0a2087fbc7519e07200999a5a922dc7098508821a73c3af64b7f4796d9ea2c4454856de539e4c49d2eaf5c40a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769803, "uuid": "00928697-4108-46e2-a094-93af10c9cdab", "value": "T1AB4178086ADE5730D3768E3758B6E3128932BC51ECB34B6D51848B8C3867600E865F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769803, "uuid": "ec79190e-bd3e-4f77-a90e-4e99f7a76436", "value": "24:8tJ/ByUl1+f28WMleYTxDAiHwJCFfNb4A/jFL4I0apgAlVu1ddzS/UtLFhwiXQ6G:8z/MgmUiQJ6bNLuIA31V1XCi3WzFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769803, "uuid": "3f9c1b22-3f6d-4992-b567-3c2db66b26e9", "value": 1943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769803, "uuid": "239802e8-ee47-4c9e-8fe6-e196784763dc", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769803, "uuid": "7da368ea-32de-4484-808b-f04301ecdd54", "value": "RankupServicefreecheatV6.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bbb2f4-d01a-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764747068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747068, "uuid": "e9e146a6-97ce-46e8-90e7-9c8001f4c7ba", "comment": "Malware payload (RemcosRAT)", "value": "df89f25b50c2234a3766899111e1478f", "object_relation": "md5", "Tag": [ { "name": "dsayankeefootball-duckdns-org", "colour": "#38DC53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747068, "uuid": "0dfac920-4e93-4b2d-a6b8-d7871dc26ac0", "comment": "Malware payload (RemcosRAT)", "value": "b5d02ff1ca8780e4705421dbf136743f8b455480cc8b8c0c9b219dda9d80573d", "object_relation": "sha256", "Tag": [ { "name": "dsayankeefootball-duckdns-org", "colour": "#38DC53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747068, "uuid": "458761d1-b844-408c-88a1-356810351269", "comment": "Malware payload (RemcosRAT)", "value": "8aea8a7c4e455c36064f824fd5f2cc6ed5074261", "object_relation": "sha1", "Tag": [ { "name": "dsayankeefootball-duckdns-org", "colour": "#38DC53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747068, "uuid": "1e4203ce-a4ec-48e8-809e-cb2adeb038b7", "comment": "Malware payload (RemcosRAT)", "value": "44491674164847798f748c5925e782c3681a696a8f1ff8144e8ff9094f6c30a6126f4de8bdc9b933e97d2cdca5cc6dfe", "object_relation": "sha3-384", "Tag": [ { "name": "dsayankeefootball-duckdns-org", "colour": "#38DC53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747068, "uuid": "e9f061ed-4919-425b-b473-088361def58d", "value": "T11196B3146BF4D098C2F6DD25EA2E2690AD0D3D2B68860C5BF43DB5AF306F55DBA30931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747068, "uuid": "bd6b02b5-ccc4-4928-b901-c8109fa00978", "value": "49152:VwcXrhhbjPMLZ9VKiOahRZEkQY8k5qaVwqkysq2w8RPn0:OcFh3PMLZ9Vnjqmwcsq2wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747068, "uuid": "0fc891f2-9d5d-43c6-9704-a9dcddbec8ef", "value": 9234208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747068, "uuid": "a293bf07-93b8-4d8a-8b25-f06e9eac6b53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747068, "uuid": "8a4516cd-767c-4f06-8eb3-f9daacf41758", "value": "b5d02ff1ca8780e4705421dbf136743f8b455480cc8b8c0c9b219dda9d80573d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1e5ab9-d051-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764770993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770993, "uuid": "960de754-fd79-4229-a445-aa8a98b3a0cd", "comment": "Malware payload (Vidar)", "value": "beeb8cfd3e1a89295c449bf7665da652", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770993, "uuid": "4276b64e-f866-48ae-8063-1c9aede7dd0b", "comment": "Malware payload (Vidar)", "value": "b62460b3255ec6bd66ff816318df1dfda5a51390427a8484b3dcd45a19484cd4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770993, "uuid": "af602bbd-1b2c-4f04-b1e3-aa1cad898f4f", "comment": "Malware payload (Vidar)", "value": "99e2e374315445db52b9e10430f7cf01a5c14fe2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770993, "uuid": "a01eba12-d95e-41f6-b92b-1dff82ef5abe", "comment": "Malware payload (Vidar)", "value": "833dd04c89bb92b715e85eecff4a3ad53087ad33cb4b540da3ebcc17d8cc408e463d5e45494007568c027dc29976ee5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770993, "uuid": "9fd85d94-9290-498a-99cc-872f59290ef9", "value": "T188366B13F9708969C4DEE077A9BBB199B674BC484B3427C36E427A251EBABC0153F704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770993, "uuid": "60005c71-5c6d-4316-a878-362842e8b1c4", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770993, "uuid": "32d5148e-9201-4509-a46d-79ebf8594d6f", "value": "49152:R0wn36MRWyHxFRX9k5cr2MS6uPaJicq8JTB1E92H0VydpcIaJ3w1R0doj+:RhSauPaJlJ91E92gGpPapw1R0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770993, "uuid": "802a6c1c-8e46-447c-94a7-3633ddc40fba", "value": 5193944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770993, "uuid": "a2f1f5a9-8756-4103-9f1b-e74996345765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770993, "uuid": "b1560180-9217-492a-a285-8b73727a73da", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7253d878-d081-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764791483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791483, "uuid": "62550b41-a426-4232-ace3-365096bb97dd", "comment": "Malware payload (Mirai)", "value": "b22671a48fcfd7510fbc8986bd875370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791483, "uuid": "7f27024b-7f82-4207-8d41-12c51f679600", "comment": "Malware payload (Mirai)", "value": "b695eed485955436ac3ac4835a3985d5872782221514796036a9e9163664bda1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791483, "uuid": "41fc002d-20c4-4560-9856-4d84cf3c7eef", "comment": "Malware payload (Mirai)", "value": "8d0bd273b3fea4861d397ef8c452831f63c899bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791483, "uuid": "055b959a-ef05-412e-8a2f-0f25ff63e33f", "comment": "Malware payload (Mirai)", "value": "ce01fa0ef80f05c533e4a6ef264bfd10d00632de85eea736c23b45c2f7b55f18898c7243fdc20b668b254f16b3117b7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791483, "uuid": "b8a2b622-9f62-4bd3-a0b1-e4ae9ddf7946", "value": "T1CEC3C81E6E229FBDF759823047F78E25975833C627E1C585E2ACD6102E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791483, "uuid": "cc29fc72-0fbf-4519-b1e3-acf2acbad186", "value": "1536:5eVxVNOugg1gILI7hvk3+y0/c2CL4x6zAX0/bGAPQxeOFTxMk5FI:kVNjgDd/c74x6zAGGAIvMk5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764791483, "uuid": "b4fc43bd-ad29-42aa-a29c-5eb17c591646", "value": 118220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764791483, "uuid": "8a689cc9-8d75-464c-b1e8-0f62d74b4f69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791483, "uuid": "aaab2c9e-25b9-4fb9-aea7-30ccc19ec4f4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afd1b3a-d07d-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764789592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789592, "uuid": "57c55e4a-bd2a-4aee-b9a2-4e7e68aadaf4", "comment": "Malware payload (ACRStealer)", "value": "11a7583a6dbb2d8af4f0c8e84ab22091", "object_relation": "md5", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789592, "uuid": "980159c8-9573-4b64-b414-8eac3cfc2392", "comment": "Malware payload (ACRStealer)", "value": "b71f9e55ad9abf550bd148ce9e7f23742103427d571a5ba9e7a90ae280701c46", "object_relation": "sha256", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789592, "uuid": "c0fccc9d-bf8f-4f81-98f8-60e03bd8027b", "comment": "Malware payload (ACRStealer)", "value": "80336ba3c00fa99ed74210d248177440cb87ff03", "object_relation": "sha1", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789592, "uuid": "2e3fd4b9-2da0-436e-bfa9-5ba419f2463c", "comment": "Malware payload (ACRStealer)", "value": "ab296d63d7d22b1f6bee52c03983a7f9a1c63ef7ab2f1e4efa69e77a5d001fa32438aae9da4a670e7b231d68851b7d99", "object_relation": "sha3-384", "Tag": [ { "name": "116-203-235-27", "colour": "#7DEBC4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789592, "uuid": "9d4ffcf2-ce86-437f-95a9-d7753f699f59", "value": "T176773339DB2E64C0FB0B45B3C36B914C42E77A4011A6DAE67B2866054D9F3E0AB37747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789592, "uuid": "9e1ced28-ee37-400e-a823-f00cd227134f", "value": "786432:BLfDRxeh8GQTGCshCVGXPMUXhQOsYseq7roJhJT+BhTouzlwLD:xTeh8vTLAYQQ7Y6AJhJTIhrlwLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789592, "uuid": "7b4b0322-1310-4477-8aa9-f3ae857837ab", "value": 35944380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789592, "uuid": "3dcd4602-5211-42cf-be9d-4175e45d1610", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789592, "uuid": "3e031f46-6928-4236-b32a-2e8a6ee30285", "value": "(1) Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd0d23-d097-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764800975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800975, "uuid": "2dcee32c-b2d9-46ea-9885-ac002e10cc6b", "comment": "Malware payload (Mirai)", "value": "fd455bf5d6db6584d2b9a0c6321dcefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800975, "uuid": "0c9a083b-212f-4b1e-a9a3-b48631ef3b6c", "comment": "Malware payload (Mirai)", "value": "b73549015f23571564beb9f7821785ef0855aac71ec0d1220dbb3ee50ba643d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800975, "uuid": "f6ce7ed1-7a4d-4872-ae47-03ea6e95ab61", "comment": "Malware payload (Mirai)", "value": "41a21d4c64b2ceb5c2858f3b65b380069e7c260b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800975, "uuid": "2d05d9cc-249a-4b47-8f9d-8e8eedba6169", "comment": "Malware payload (Mirai)", "value": "36f0d0747d7c85bfc427453a6c2fdf22064f915970a42d4c1ece9b8693c0cc380773156b3f3496e7709ef3092b31764a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800975, "uuid": "d9a0212f-ad26-47e2-af96-3714477844ed", "value": "T19454A71A3A129F7FF76D827507F78A745B5836D22AA0C184E17CD61C1FA02CE245FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800975, "uuid": "7588614b-c6d3-4a1a-a699-cb15233b8cb5", "value": "3072:mnJn3dpY3ShuSqASLrSUW4RIXgNnHw9dDu3s1v/5TJ6Mn/U3PzpxrGX3YuO9V:uJn37Y3YSCUygnQ9dDNRx03txiX3YuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764800975, "uuid": "f49afbf9-8108-401a-9d8c-c34d2a81a9bd", "value": 280712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764800975, "uuid": "3ff6f096-ff95-4b28-9703-40de797e8c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800975, "uuid": "0b91c54d-d4c4-4bb4-a764-dcaeee3d9481", "value": "sync.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2050ed87-d091-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764798217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798217, "uuid": "b0daf233-fc4b-47a4-81a7-a5a56403af6b", "comment": "Malware payload", "value": "46dfb31791f84e051009dbe62f360533", "object_relation": "md5", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798217, "uuid": "a0720f73-54e7-4ffe-91c7-beecb7de550a", "comment": "Malware payload", "value": "b7480762419475bca606e1b1c86534999bb0303a1d43d9c072b1b517ce67a6d9", "object_relation": "sha256", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798217, "uuid": "2bed575a-43c0-4419-a0b6-80eaed9dca90", "comment": "Malware payload", "value": "23c21d9092852ea5e9cc0838969be8bf7b6f59d3", "object_relation": "sha1", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798217, "uuid": "ce95028b-6579-407c-913d-c9a7b37ae389", "comment": "Malware payload", "value": "0af8f92cbf2722be4e73255c8b1a19119fcfd15215a4de2216a9d4c265b89d616d0b12004a81a5727102495e3b1ca196", "object_relation": "sha3-384", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798217, "uuid": "6d0e110a-74b9-4947-8934-66821aae1c1a", "value": "T16382A6BE3E92B536838BD07FACAAA0047576C15B420D2D08FEDC92742F9437481E97E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798217, "uuid": "ae3cf531-2738-4c33-97ff-e70f49c01e00", "value": "192:Euf0iQzvQ01vXtsrz5V1qwnRoYCeU+MsMf1iJMIdMn/xY2e1VGSY4GtUxkSVVIGj:EuGvQhEwnR6/gmL5hvCo6EFcaZXkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798217, "uuid": "7745100e-2ea3-4c15-bd0d-98520386cf0c", "value": 18966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798217, "uuid": "878c34db-8ce2-4943-8d1e-3a33fe335bce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798217, "uuid": "6516ec6c-ee3e-40c9-b8ef-f421c2acc71e", "value": "system.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e76dfb-d005-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764738200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738200, "uuid": "7ccfce7b-8004-402a-b9ea-68e6d0e7650e", "comment": "Malware payload (Mirai)", "value": "7a80c1c82e7bf6ceb2a037de0cea91cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738200, "uuid": "4f66854a-08ff-4804-bfb0-36a879399e1b", "comment": "Malware payload (Mirai)", "value": "b8bc0566fdc98dde8c7ff22f813bddaa840c7feae97f3284fd4c1d1b6bf4b257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738200, "uuid": "63a10481-1a18-4b65-bfd5-923a364edd14", "comment": "Malware payload (Mirai)", "value": "88d243fbcde352ca0b464dbdd817acbc2e9cd958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738200, "uuid": "acb410e9-c14c-412b-9042-a3b9ec2a0184", "comment": "Malware payload (Mirai)", "value": "62d44e4f7fefdf2fd2269bf56792f7caa4a3e4fbab29f22e101fdb854743e92226d038e0c6d838152a8c4cd51498c127", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738200, "uuid": "a3403745-a4d3-435d-9fd5-fd8c00ee174f", "value": "T1BC431992BD92896EC6D003B6B76E198D33A263A9D2CF3713DC444F1063C961E8E37E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738200, "uuid": "e25d48e3-6724-44a3-a859-285d45015da6", "value": "1536:qMuN/0Is9Slmk47ZKJ8+opfVn3w1V9rpP:qTNM79SluH+oPn3uTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764738200, "uuid": "5ea654c9-5596-403d-98e9-585038a2c8b9", "value": 59132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764738200, "uuid": "49107d94-46bd-44bd-be7e-ede229d0b375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738200, "uuid": "1aa70e90-900a-4c7d-8f30-de52379d7a0e", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c213de1-d042-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764764361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764361, "uuid": "c6076b2a-4b2c-437b-a465-2a2631afaf9d", "comment": "Malware payload (Mirai)", "value": "016f9f1e287cc55895265c530247d5d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764361, "uuid": "c428e324-5f5f-4ded-bd29-fd0111dac677", "comment": "Malware payload (Mirai)", "value": "b8be5713d46ca9f111456587eb1d1de5be70577472ddefd84fcf772c7c15bb11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764361, "uuid": "0bcab0fb-1c4b-45d6-96eb-c8d406942c36", "comment": "Malware payload (Mirai)", "value": "1cf53af0d2f44b496bdbbf40504c7c546964bef6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764361, "uuid": "137a5844-7046-40be-952e-0fb23719556d", "comment": "Malware payload (Mirai)", "value": "d8b5b5f3854d587dea79c8c549823d8e22a814bc00b664cfa1838337cc684e6bee3e29689f37b5244df1965251a0dcd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764361, "uuid": "c0acd998-e358-4c0c-af19-dffc4e3ad4bd", "value": "T1E0A33C46BCE1CA6AC6D023BBBB2E219C332153E8C2EF7117DC24176826C645E1F37A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764361, "uuid": "9467207a-3236-450b-9211-93739c23f25c", "value": "1536:WgPBnECUZ5pXj2iAY/Etrbd6j5z2gltS5JGyf5XK856Vv2AgKKakxpqWwQvvpbbX:/aZ7Xj2IjsnwJM9BbXpbbH5iqeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764361, "uuid": "87b5ce76-6a0f-4702-b9ef-bdfa2edb0ffb", "value": 100224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764361, "uuid": "90669a7e-0e4b-458e-8b03-03c684720b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764361, "uuid": "952cdc51-a0a2-4bfc-a2d9-472d52a6a9d3", "value": "Yboats.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917730ca-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767913, "uuid": "77320850-c086-4384-93f2-2297cf8c292e", "comment": "Malware payload (Mirai)", "value": "9b048a25e442d2e131e114ec808c5fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767913, "uuid": "727095fe-802b-4d41-abfd-8309e6954498", "comment": "Malware payload (Mirai)", "value": "b9527cfbbc7c89fb1e378db72aa00cd078db99c581b45bf41da4f16bec32af73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767913, "uuid": "492c7b9f-b68d-4d0c-bbad-4b9976813642", "comment": "Malware payload (Mirai)", "value": "3c390a981bfd1b24733e66b3422b8fb87442ed1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767913, "uuid": "03579c20-90f6-452e-9a6a-15f4ccd1efc0", "comment": "Malware payload (Mirai)", "value": "fb4c78f5bd629eda3e890abd14e4748cc9da7be489910bab1e68eb7548a5831f0c3fb119075c7b219793f472d447157f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767913, "uuid": "2c5995b0-3b4f-40bc-b4a3-0d2cc7f017ef", "value": "T1A5F3E80AEB710FF7ECAFCD3705A91746259C581622A82F727630D46CF68B28F25D3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767913, "uuid": "6b606774-2088-4221-a97d-9c952e42ffcd", "value": "3072:QLqolg1R7OscR6NLctYns7SeYl/vQ8zVFP:loq1R5jNItV18zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767913, "uuid": "65b437bc-12c8-4c10-873c-ab30b896615d", "value": 159280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767913, "uuid": "9d2b1c4a-6461-4b74-9398-7569358af33e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767913, "uuid": "cfa99e4d-3442-4719-8877-2e273e478f24", "value": "SecuriteInfo.com.Linux.Siggen.9999.142.20025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d9c666-d07d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764789789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789789, "uuid": "eff807c1-0770-4089-9d91-f9bb46ecc3ef", "comment": "Malware payload", "value": "2e263d087f12ef9259a9c9dd75de15db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789789, "uuid": "dd79ffb6-b6ed-4068-9ad7-f9a135cd9674", "comment": "Malware payload", "value": "b9cb9cf246d2d9d8a4bff2d7758267af69bcb1f3179d104d66eb0a73e54ab524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789789, "uuid": "40ffea80-f743-48df-9b0a-924255a1802e", "comment": "Malware payload", "value": "6e239971b5ec10dacbaa335940137ac45ff68729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789789, "uuid": "e3c9c3ca-aa1e-4223-8e56-94fbda546eee", "comment": "Malware payload", "value": "057e302a31ebc6fcbbf945270e05bd36760ac7d0f521e7fff26482e00c8d36a9456a1484816a17c52f401220b39c449d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789789, "uuid": "58dc8f49-095c-4e6f-a778-2d1db5f5fe7e", "value": "T1DA551212B7C4C473D4B219328AB1DB24163C79612F6249CB63D03DAEAB709D2D631FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789789, "uuid": "3f2031f2-b10b-4578-b3b2-e98848938f91", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789789, "uuid": "b3016642-2f43-48a3-b18c-adeeb383034c", "value": "24576:bN/BUBb+tYjBFHNuuNVt0cnmZYZhd3tyLjwsrBXuXiM0hD6di/AwV:JpUlRhNV7uUmEhd3tyLj5RuXiM0hDT1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789789, "uuid": "9cb2e7a7-1953-49ab-a0d1-75fa17807558", "value": 1341800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789789, "uuid": "32db4e34-585b-49a8-9a03-1d44595cde38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789789, "uuid": "fd41d857-cbad-4d51-9981-935a16cc06f8", "value": "Adjunto copia de audiencia nro.585745814.rev.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee52cc49-d053-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764771934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771934, "uuid": "faf0ccfa-3ff2-4cf8-a78f-e3791ef8f032", "comment": "Malware payload (GuLoader)", "value": "ce398e9f13536f8da1e1f1634b0a9427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771934, "uuid": "9a1633f2-5547-4b63-92da-845cf1dd1985", "comment": "Malware payload (GuLoader)", "value": "b9e747c4fe5dd06c116cf1e2d7d924b52807b12bd396238cee1e84187ea1b793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771934, "uuid": "fe997a73-20cf-4522-97e6-305b27d0be7d", "comment": "Malware payload (GuLoader)", "value": "b770e256ec17d8e7f2522d103eacbbce04ec5519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771934, "uuid": "063979e4-13b0-4007-9c29-5fc0897887fc", "comment": "Malware payload (GuLoader)", "value": "cfb615242e559fccf77664f0c8db317067b9c670516da8566ccecef63ed9babc51360844d85feba3dc52bfd0c1a918df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771934, "uuid": "66ac4067-243d-4c03-9b98-60064c5afdeb", "value": "T150D411D1B240E166F78B00B0C17B5EFAD6795DD9D88747076B25BFBD7A332A2002864B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771934, "uuid": "b3924a4b-b13b-4ae9-b12f-daa7000a7f57", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771934, "uuid": "36b8ff60-a1f2-42ba-b221-a3bc963cdc98", "value": "12288:rkTBokEndGFaep4nIVszMZyWVQWzaVzqSOUe9c+mCJD9EHezRH++Sq9:gtNEwxp4n07ZyWVKVu9c+rJREHep7Sq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764771934, "uuid": "32357af0-4987-4c21-97f1-ffd24c7a674c", "value": 630760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764771934, "uuid": "6dd9eaea-c5ca-4cbe-a3d3-025b91469e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771934, "uuid": "c28e4cb5-7c14-47bc-85f2-b286286a0e00", "value": "FATURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6e68de-d03f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763017, "uuid": "01ab1fbf-c7b0-488c-a6bc-39c04b033737", "comment": "Malware payload (Mirai)", "value": "80252cb7133c089d7be0e803fa0b4bfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763017, "uuid": "86d88c53-e6b3-4121-91e0-998e05eb4bd0", "comment": "Malware payload (Mirai)", "value": "ba0f7282b69b6308ba074c57bfd3b7b32445eec6ff984e68a61d17a172ef428d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763017, "uuid": "69d42033-d904-4e82-99b1-e20c5a3d5d6a", "comment": "Malware payload (Mirai)", "value": "76a33079bcb0fd8ec1a3eff1be1348a952f04a92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763017, "uuid": "59cf92db-0b99-458c-9f6a-7a752f550d92", "comment": "Malware payload (Mirai)", "value": "9979811e97a14baca258d95f6930ab7ec0775148643d56a6dcf6a0bd92f47ba70c92a57d93ff56ef66208c2466a68a1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763017, "uuid": "3a1347a0-6e39-431e-8384-7cb48bd02548", "value": "T176630271D802A50290FB48F7F63D61069759FFADF46B3269F229684C38CF758A358932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763017, "uuid": "07c4f281-cb51-4809-9b81-c2ceaa7927dc", "value": "1536:Uxjs6OKiI531h8V/4hHTd+Tvai8CqRXxHvRHM7lzsBN:eshK39j8OhHhzi81XxPtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763017, "uuid": "3fe8ced4-3457-4601-ae9b-ac8f8d06d60d", "value": 71492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763017, "uuid": "b15848c2-2a6d-4cd1-a445-89fa2393465f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763017, "uuid": "79eda255-bc70-478f-9d06-c373b2c9f07d", "value": "SecuriteInfo.com.Linux.Siggen.9999.9876.22098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee2f1f2-cfdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764721953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721953, "uuid": "f4a57272-d064-442d-b70f-954b7436d054", "comment": "Malware payload (Mirai)", "value": "0cc05250ab6a195350d887d5a5ca839f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721953, "uuid": "9312f2a6-107a-4319-bf4b-76a6bb9b87bc", "comment": "Malware payload (Mirai)", "value": "ba69344e4f9b1497c002e8c8b85710704d7ac7bd40ab643f7ea6600b0be9e9a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721953, "uuid": "3c49ca49-f68f-4ce2-9439-f1899be29d75", "comment": "Malware payload (Mirai)", "value": "aef4f080c1d6e57fde535d5b9d6f8aa79f5f9b41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721953, "uuid": "52988e65-0f34-4958-a8a2-5f6025a5c3ef", "comment": "Malware payload (Mirai)", "value": "3d367c80c5c3af98a487a2f1ca84c35496dccf38250a1c2134ecf9e8f24667272fb160b89561988f66201e53df6816e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721953, "uuid": "0d29381a-302a-47c2-aea7-4da8e898155e", "value": "T10C14C60AAB610FBBDCAFCD3706E9070125CCA41722A86F357674D528F54A64F4AE3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721953, "uuid": "cfd47643-44ae-4d67-972f-f333c01f3adf", "value": "3072:glvitp2/92uJmW62SEFqRK3JWHzkCm4BxO:glvQg/1AW6fmqRK5skCm4Bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764721953, "uuid": "5b311f1b-a198-44d9-a2ea-5f4974f27628", "value": 202968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764721953, "uuid": "2a69f72d-4279-4a9e-835c-d3c50a8ebd1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721953, "uuid": "f68aee19-385a-49ad-b9c9-a00013635f28", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524b27eb-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767378, "uuid": "22f9a713-1322-41bd-a7ef-046f7ae80cfb", "comment": "Malware payload (Mirai)", "value": "201f5614ba6ca1a088ada87f30f98a53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767378, "uuid": "121136ba-349e-44ad-98aa-1067b17e4eba", "comment": "Malware payload (Mirai)", "value": "ba7c392750fef6008e94cbe249e1f9582da49a5d7692f445debc739937d8f45d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767378, "uuid": "434eecce-ceec-4dae-b187-aefc45a98be9", "comment": "Malware payload (Mirai)", "value": "d167e3354f863920002ebde3418499c98ee9569b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767378, "uuid": "c6f22f46-504c-42db-b58c-587e6578c7eb", "comment": "Malware payload (Mirai)", "value": "23738e42bde52c23998788c670eb840678fb23dee0816623a1e1c8731dfe49b883192d7287e1e97c46b89b8571a23b8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767378, "uuid": "985a8194-e6cf-42ea-9b0c-4f5ffc72556b", "value": "T110F2F891B8825A2BC2E423BAAA6F518E336173ACD3CF7717D8111F507B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767378, "uuid": "372bf3c2-f0f5-4bd4-84d3-27dd228b0b55", "value": "768:CzQJzX74uXq3GpKWKKZSo2Tjupjq3e+aErP76MjG:RXJXmGH2T+8SErP7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767378, "uuid": "473fc717-8277-4208-aaca-0eb1233872f7", "value": 37120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767378, "uuid": "c8574e04-7538-4794-87c0-5730350cd9b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767378, "uuid": "1fea21d9-2c7e-40c0-b996-4561d39a9e45", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fd2a10-d07a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764788531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788531, "uuid": "61043eb8-87ec-42ac-80dd-dc057e0a6a89", "comment": "Malware payload (CoinMiner)", "value": "4536be40ae709b3448a95964b6ef1fed", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788531, "uuid": "83adc44d-258c-45e5-bb4c-180a66823459", "comment": "Malware payload (CoinMiner)", "value": "ba8926f7954f7075ee7d4e8b27a94c5e4ad7ed1676e5b096bdbbc1f26ba79257", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788531, "uuid": "f164f972-28a3-42e3-9c85-4e2c3a24d891", "comment": "Malware payload (CoinMiner)", "value": "245a73dde823d24b76642d0009c017b636b46ecb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788531, "uuid": "efffd352-289f-4b26-8023-565f699f1309", "comment": "Malware payload (CoinMiner)", "value": "72949c6a9cf7a7e558cb5685d2faf519e3066a3fb72370c92fea34fee75a148cdcd53b3b0f711e1f33ab83a66f42201d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788531, "uuid": "725dd3df-06a0-405b-8162-5db76ad00f66", "value": "T122167E1AFBA510F9ED67C63CC9424902EB72BC564761E6CF13904A962F237D09E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788531, "uuid": "7bae71b9-6284-4edb-aefd-db4b6aef9679", "value": "9c39cacee256aea7699b759872a7c139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788531, "uuid": "8b257a4d-1d19-4446-8a50-eef016cf4f69", "value": "6144:wouIJZ7ej03GzVCjlcAlB4m+N29/8KjSIud:wouq00+V4DlBR+Ny/1vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788531, "uuid": "11137f9e-0454-44ca-b902-0a8f75339955", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788531, "uuid": "5d4ce770-8c8d-4c4e-b5bb-5e623467b7ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788531, "uuid": "094384b4-de40-400a-bffd-9315dffd8676", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059e7014-d042-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764764242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764242, "uuid": "c80f780d-1e35-43ff-944d-94ac77e1961b", "comment": "Malware payload (Mirai)", "value": "d6ffc34dcf2f284e975dd24477398fcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764242, "uuid": "14a17f90-789a-4671-937f-5f650aaa996e", "comment": "Malware payload (Mirai)", "value": "bac0638d849bcb2fffb082c4a1ba1150128decf713a39a5ab4d6d76731e45873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764242, "uuid": "022404f6-b513-409f-b96a-3e3669345586", "comment": "Malware payload (Mirai)", "value": "9915a19dfde5a9ce6b392ffb385c9c06397120c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764764242, "uuid": "fb4524a7-2fa9-4015-89df-c04fddf26673", "comment": "Malware payload (Mirai)", "value": "336ceed30ccd821bddfa67eb648367fae8a3aba18316d6463ac26607b2e1e8f11a91025a02ea70f58122c3b60f1ee13e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764242, "uuid": "ccf208be-e51c-43f1-8861-296f253b71b1", "value": "T1D5C35D42B7580A87F5534EB5283F1BD063AEEE9021F0B684798FDA4E5271D732546ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764242, "uuid": "195109f3-e6e5-40b0-8be5-ffc3a433c4a5", "value": "1536:rf6KNBfXvi1Bj6VYVcNavqJvX43CAW1h248D4GWbs6toOGfIMyi+QzxdTPsa:LziFVcN/0h54jgOGfI6+MEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764764242, "uuid": "47c9dede-620a-4634-afac-1913c3744258", "value": 121464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764764242, "uuid": "d391a384-76f3-4524-bdde-185bee55fba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764764242, "uuid": "6063b7b8-9d1d-4c25-b68f-770983c30339", "value": "Yboats.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896b19c7-d091-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764798394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798394, "uuid": "1e770a2a-fd2d-4811-9708-becac8e0a5bb", "comment": "Malware payload (Socks5Systemz)", "value": "1ef957a43aa9c803c5f96f3f8261b365", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798394, "uuid": "01ee75d6-6027-41d7-a588-a8adb54a04c9", "comment": "Malware payload (Socks5Systemz)", "value": "bae5d9c81d7142b9cf994402b2648d70cf90271a31435d92fdcb87c422b00a17", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798394, "uuid": "d28eba92-ed16-468b-aa2d-d86efa81a82a", "comment": "Malware payload (Socks5Systemz)", "value": "85e9d299582c3645b10d4791e2f2099f0ec7780c", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798394, "uuid": "cefba7f8-4c18-4a19-a0d7-3bf58df6eac0", "comment": "Malware payload (Socks5Systemz)", "value": "e377e2a97e77e15ea0734dbac25be3d86278dd0554c858be907386278a7f1dac47ca6bf077cbcecb9af9457fc3c9a43a", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798394, "uuid": "81858668-b26b-4786-a795-b7be017d7da7", "value": "T15EF533B34B808179C2F6A73558048A0DCD377E15073496D93BEF4F8C2F8BA88756A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798394, "uuid": "55fc1d89-8d4c-45a0-8713-331895f399e7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798394, "uuid": "6152ab40-22a8-4a1c-b932-1e203f3af0c3", "value": "98304:MzC8ZtmBkEMmU9s6j4T2S2tduH3ejVm/uOWZ8yl+:C+/t8j4aS2q3ejVmHWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798394, "uuid": "4f981271-1bdb-4172-bb3d-47be5ce3b200", "value": 3321276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798394, "uuid": "fba0bbb9-95ec-463e-b48a-65aceaa35b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798394, "uuid": "8b1f11c5-10c4-41f8-b41c-fe7c0b921422", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892a762b-cfff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735687, "uuid": "b2aaaf42-00a6-46a1-9840-0107f652e8e6", "comment": "Malware payload (Mirai)", "value": "dc8379bc8ff25454603c8d8f097ad945", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735687, "uuid": "d3e728bb-6f80-4e3b-9f1e-84aae34b99f3", "comment": "Malware payload (Mirai)", "value": "bb0e4de4d49c2aa97efa4b1be8bbea4471a03ee8405be703ac10177750d0da8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735687, "uuid": "f5459a57-240b-4a10-a1ba-809e731f840c", "comment": "Malware payload (Mirai)", "value": "e790ca5f48d20c6812083bb41f4cb9b3a583eac1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735687, "uuid": "a76945d0-a9fb-4a03-91c0-e8bedf7a8fd5", "comment": "Malware payload (Mirai)", "value": "7b75af5c50597828b4a6ac5e5031e98020377a6cc3185213f85db36d7464ac8bcbeabf0aa950685bf3418698af9776d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735687, "uuid": "7e9f2bf3-c4d6-4152-8b29-fc04256964f8", "value": "T140B34963CC6A6F58D629D1B0B0B58F791B5399A0814B4FBE2967C2798043DCDF6053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735687, "uuid": "bf409799-0d13-40c4-9a20-5ecc49d5a554", "value": "1536:FlcS7y0ZbCwKbGuj7BtSrozNzEX6WQrgyR15fHK/gq:Fqwy0dGbJ6ro1S6WQMyR3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735687, "uuid": "16dad77b-e44e-499c-abdf-330c7dac9efa", "value": 113476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735687, "uuid": "0dfa478d-4b4b-4268-b01a-21794ea2239f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735687, "uuid": "dfb706a9-0baa-468f-a115-2cbdc73f89fa", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00d6bc7-d018-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746543, "uuid": "ed4b2541-d731-4dd1-9f81-5d94e1569f56", "comment": "Malware payload (RemcosRAT)", "value": "888759df348c945e69f3ae5f7a136c48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "practicalplayercontact-duckdns-org", "colour": "#806685", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746543, "uuid": "962b194b-eab9-4f09-b0c7-a03c838ca825", "comment": "Malware payload (RemcosRAT)", "value": "bb26dc2c9d24b4c54c6f1cae6958197b1a7667eeff52bf6e6559aab475f06f5f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "practicalplayercontact-duckdns-org", "colour": "#806685", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746543, "uuid": "45bab670-d3f2-48a4-8161-0b8bad11f5b6", "comment": "Malware payload (RemcosRAT)", "value": "df4af27d89da20c4f1c71e6c5a7d5de619c9115d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "practicalplayercontact-duckdns-org", "colour": "#806685", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746543, "uuid": "06c3ecfe-4944-4a19-8237-00ff93d276a2", "comment": "Malware payload (RemcosRAT)", "value": "3b5c361ac4237c44a5da6691e68e18e328fe307623d0004242b0f42f6f48015ab1310a64c7f7ea7ab18d37ceb54c30bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "practicalplayercontact-duckdns-org", "colour": "#806685", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746543, "uuid": "14103580-b6ad-4fff-81cb-2d2b0cf1149a", "value": "T13B96B61927E4D09BC6E6EEF5EA2D2690AC0E2D1728D20C4BF529756B306F85CF630D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746543, "uuid": "9c51e0c0-b6df-4770-b0f5-38a99fa0d3fa", "value": "98304:bFV1s7hyE3cJ93rqLXxmNCZ0/NBU5IVJ5EDsQAg:e7hyT77qlFZ0/NBU5IVJFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746543, "uuid": "49697813-6606-4cea-96df-d0cee1d76da5", "value": 9234208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746543, "uuid": "d5fe7f81-66e6-434f-95e1-027bf4cdb78e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746543, "uuid": "f4a258c7-a82d-4f78-87ba-92c00bf277fb", "value": "bb26dc2c9d24b4c54c6f1cae6958197b1a7667eeff52bf6e6559aab475f06f5f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18824c21-d045-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764765563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765563, "uuid": "4bd37465-2765-4ccc-88a6-109455fb3284", "comment": "Malware payload", "value": "8003c64a7a50db2171ed023a8dd0c368", "object_relation": "md5", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765563, "uuid": "91f586f2-307e-47c2-8806-018c181583cb", "comment": "Malware payload", "value": "bb68992f6aa2d3f316322e88d9e71491a38e95fd3a27f48084c66b9c210bd17d", "object_relation": "sha256", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765563, "uuid": "7dd046ad-6e68-47e2-ae41-0e0fe68d70cc", "comment": "Malware payload", "value": "a1fb79257e0a04994921c1bb540aa1851bdefce1", "object_relation": "sha1", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765563, "uuid": "4a22486d-aca3-464b-a701-86fc456c6a9f", "comment": "Malware payload", "value": "0c16e5a612a10ce10d8305aa50812504c809fac48a70cb363b3fe7034c001aed81b5a56e5ab64453b15b21cdcdb0f0f1", "object_relation": "sha3-384", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765563, "uuid": "198dc986-af4b-4357-bf26-8eb4afa78a14", "value": "T12EB6E099B7FCC043DE3EF072FDA291128FACA2C56891F40F19DD12CBAC5267116958AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765563, "uuid": "cf84a8f9-f872-46c4-bdd0-112c345038b4", "value": "196608:30BUaNt19PqhHBg+AexeVOf3mfCSBSeyYZfoWdrVi0Xv3HXgD/iMFNIHme:3KXyhHBg3/g+KSBSeyYZfzV3f3QD/pMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764765563, "uuid": "f089936d-794a-43a4-b15c-fd4c2a234814", "value": 11356317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764765563, "uuid": "238c2f19-68c6-4123-848e-566bdb1e31bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765563, "uuid": "e9095427-b0eb-4b36-94f1-d99597c92619", "value": "react-native-vscode.1.13.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c12e54-d064-11f0-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1764779250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779250, "uuid": "0c1e3e2b-389d-4ee2-9ba0-a0975233cc09", "comment": "Malware payload (MeshAgent)", "value": "cf636c14b01eec9fb05abe7a23a0aafd", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779250, "uuid": "d0bb05cb-8603-4861-ba17-585d3d5818fb", "comment": "Malware payload (MeshAgent)", "value": "bc203e057ab874aac7f8e033d3bca4325296757df055fd4ef81a6d5d72d2733d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779250, "uuid": "dfcd4eb4-ede1-44b4-8a3b-dae91738eb05", "comment": "Malware payload (MeshAgent)", "value": "5fec0ffccfcb87358685d11d17f98a461d60e12f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764779250, "uuid": "4dc46579-ff89-49a3-947a-a1d219ca095e", "comment": "Malware payload (MeshAgent)", "value": "53e760a1362143d28be747269dc8adc5610ce9ed49e6d35c84072330fe467c4f83e1da06dfd5f389a74308318879c0fe", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779250, "uuid": "226bf9e7-aa6b-43b3-aea7-a940d0c943e6", "value": "T1B9F58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779250, "uuid": "e478c3b1-083e-4d5d-8dc0-b61b1927d8ef", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779250, "uuid": "e791c4c6-4dd6-4bce-9251-08ac7ac6b2a9", "value": "49152:7dZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxM5C6L:pHvfGfZvZj1/N/z/oMUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764779250, "uuid": "2d909bd7-a6e8-47e5-b2db-a1b35642b7f7", "value": 3519160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764779250, "uuid": "4ca49239-40f7-473e-a9c4-5e3f359c0c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764779250, "uuid": "40842ca2-587f-45f8-b151-26349725e1cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1f1030-d023-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764751177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751177, "uuid": "afa14c49-dc37-4f6f-a645-19182acccd96", "comment": "Malware payload (NetSupport)", "value": "8672c8d7f9f2c27ba44fb4c8b7f09106", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751177, "uuid": "1a1fcc47-29ce-4831-b324-ebb39c065a42", "comment": "Malware payload (NetSupport)", "value": "bc764c36318d4bcfb5a4058dc7e5b1039405c4426833088019a0475005931fe7", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751177, "uuid": "026f562d-4ea3-4fb7-84d4-8e4d86c7e360", "comment": "Malware payload (NetSupport)", "value": "9461a67fa5d0ac5366dd070d37d46c074d82f90d", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751177, "uuid": "ceacfe0b-dd59-405c-8f5f-4d19aad7e78c", "comment": "Malware payload (NetSupport)", "value": "77db004165e85adbb8b306787565ad5692c38f761702974e03e8f6e411a699bbcbb3721ef1d12a486983da2dac5a0a57", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751177, "uuid": "113e79c4-65b3-491c-8e82-53a622cd298d", "value": "T173767D32C4177C3A3D5D394B90042E819EB91E9B5B188A46FB20B77DA1E4D75BE3C4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751177, "uuid": "df458297-836c-4813-ae7e-187b7a724b22", "value": "49152:a10mX3JXU+yY/F4+9o5Py/nNASN/fGntlHFr5KkhLRNN8NAQIs8VWBwjHWADEoM6:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764751177, "uuid": "610ca8df-95d3-401f-bd4f-1649f889b417", "value": 7278780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764751177, "uuid": "b9f07bed-0bb1-47dc-90e0-4a2397fe1600", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751177, "uuid": "e3bb2adc-7fe9-4432-8742-d0e80f47c91a", "value": "ledgerio.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313afb65-d073-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764785361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764785361, "uuid": "6c4bac67-b085-4076-8fb9-a512bc31a24e", "comment": "Malware payload (Mirai)", "value": "996e511673ddf944faf30697db03c70d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764785361, "uuid": "7d58689e-54ba-4ca4-859f-42744e887ae9", "comment": "Malware payload (Mirai)", "value": "bcee999cac8f6fb61ccc6eaa4d6ab7b046f1c47de8accae3226e1f057d58680a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764785361, "uuid": "570ecd31-0a38-4992-b0df-b51a657ee23a", "comment": "Malware payload (Mirai)", "value": "6085937b4e755de7a9f31f15ee71bb518b92671f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764785361, "uuid": "78268796-0393-44a9-8408-50390a458d7a", "comment": "Malware payload (Mirai)", "value": "ddf757980167631be9d75830bd66b9e7c02b1faeead143cf2d2bd760b47e1f18f91ae9bf316e3afbd973c1fde6fd57ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764785361, "uuid": "a25354c0-4f06-4116-8114-88dd1135eca2", "value": "T16AC35B366E772D67C2D564BB02B30322B1F7138A30B8CA1D7DB00E5DAF58660715767A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764785361, "uuid": "3b8de9a5-d83a-4e59-bcfd-417ff8161aab", "value": "1536:RR4AHbhl9FjjIPzDLpk6JRWMfhviY+xT0Cd/MMwlk59ZDVttcO9YVg1+N:z4KtKlPemhLoAMwlULdy2oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764785361, "uuid": "18b9974b-d986-4d9d-b912-e034d1eedabb", "value": 128368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764785361, "uuid": "679b4fa8-88d9-4a2a-80c8-18e55acec431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764785361, "uuid": "8f21d30b-9e8a-4a1f-ab89-d57e3ae49efd", "value": "Yboats.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28173622-d017-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764745832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745832, "uuid": "4aa38ad0-1c2b-4098-8e7d-3f4007bec8ba", "comment": "Malware payload (XWorm)", "value": "98a0c7c669c2429b3831fde8f083c057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745832, "uuid": "871690f3-2a61-4660-88ce-f78e9e0f74f1", "comment": "Malware payload (XWorm)", "value": "bd1c03ebbcedd44270163b446545ccb9eae0cbc918f640e1c5ae339410ea7a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745832, "uuid": "ac8c2e65-6660-451d-9439-e7693187e2cb", "comment": "Malware payload (XWorm)", "value": "b7ce5f96791dde92ca03490649cdcefb48770cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745832, "uuid": "1e643855-b82d-40c7-9f8f-b79bee3d83f5", "comment": "Malware payload (XWorm)", "value": "6f10a3c176a89acaaeda7f0a5b45c6e6ebaf7a0d43895a3709529f66547f76cc35413e01a9c6074af81e0fabdcd889ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword1-duckdns-org", "colour": "#10CE29", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745832, "uuid": "5d450b3a-a685-42e4-8546-37782c911fbe", "value": "T1AAE38E00B1D28435F5B31A7659B49DA98A3DFE300B119EEFF388056F4F315D0A935AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745832, "uuid": "dfe1a2bf-a650-41b2-a222-f03a7f7d4992", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745832, "uuid": "62ea61db-845b-4666-88f1-6fa6ceb69360", "value": "3072:k3AlCua6Ty3XctCkh3jBzBueU9audXzWcXaw3aRHn0Sz5wApIOz7U8:dlHWct/jKdXf3aRHn0q5wApIiU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745832, "uuid": "59d88549-975f-4190-8025-d17936ec6b91", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745832, "uuid": "f51ce7c2-310a-4d20-832c-e8a807a1c2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745832, "uuid": "8a57291a-3934-4090-98a8-f6e7a6153502", "value": "bd1c03ebbcedd44270163b446545ccb9eae0cbc918f640e1c5ae339410ea7a1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd45bfbf-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749572, "uuid": "c7dbad27-fb63-43f0-94de-e3d73e06cb4a", "comment": "Malware payload", "value": "fb1df31c32c2915a308f4ce8ffe6702a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749572, "uuid": "11af4a17-e2de-4b57-b4b1-7a50fdc247bb", "comment": "Malware payload", "value": "be0dc9c357dc07de8b013d1153c3aa7ab8e5a4f0000328804753e23231bf794e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749572, "uuid": "15f3e350-a96b-4b0d-a819-463cb8210bad", "comment": "Malware payload", "value": "eb12b66ff4393087cb84784fdf68d985dbe11486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749572, "uuid": "5b4511cc-6879-4ba7-ba15-3ab9ff147bfb", "comment": "Malware payload", "value": "68a7bc5fa1dca71b169180d77f9b44c42871b3a01fdcabc3a023afda2864bfb649d62266a1b600abc090af998c2d25d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749572, "uuid": "2f00cd26-77e7-4727-a15b-76988f67ca6c", "value": "T13DE5194369EB0DE9CED677B8A1D31335A734FD31CA295F2BA608C23129536C4AD5AF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749572, "uuid": "b280bc77-b59f-4712-a192-bc2472ef0ad8", "value": "1f5540627e3eb3dfc91cca2a5167b658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749572, "uuid": "48d785a4-713d-4e61-9728-56795f91f8db", "value": "49152:gbWsSM2yVo+sViyIhBwlZ3S5huGOpoExLsv3c:O52yVo+sVjlZ3S5huGOpoExLsv3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749572, "uuid": "fe24a8d8-77fa-4e1b-8aa4-4a45908e5d70", "value": 3026042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749572, "uuid": "8fab98c0-e34b-42b4-a660-b11660904dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749572, "uuid": "926c53bd-e1d5-42ac-8c20-50a4425b9007", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8788223-d059-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1764774448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774448, "uuid": "502e16c7-034c-4cc1-9e59-b6938c74f21d", "comment": "Malware payload (GCleaner)", "value": "ac0bf28ffe0578b31a0dc302e79e5656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774448, "uuid": "6d9ba416-25a7-4692-9136-2e977d3a6b6b", "comment": "Malware payload (GCleaner)", "value": "be3164cb1a4925491c0265f3c9a717c89218b7f47c2fb603c8f7f69309a39b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774448, "uuid": "3ced23d0-1d95-43a3-ac6e-7a74283c3288", "comment": "Malware payload (GCleaner)", "value": "f73e6abdb6748ce4f9089933441aae600663d631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764774448, "uuid": "19ea142d-156a-496b-ba6b-20a035f4ec8f", "comment": "Malware payload (GCleaner)", "value": "b54b7849a7e30ce35d9e0837cc5973a8412aae46361c571fcff23a770454a7501aa6b899223a0dfa6748aeac1f2cdd8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774448, "uuid": "983394f9-eb27-46c4-ace9-8f9a27954f2c", "value": "T1FB56D0DFD3B89921D1416FFA7A3ABE7678A0A9C3E514C60A7A96C24F70E7601344C1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774448, "uuid": "e8456141-7607-4776-ab9e-e4ae72030c56", "value": "64e1668316d54cfec3d25bf814f73886", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774448, "uuid": "a1f61656-5916-4de5-bad0-25295f257d34", "value": "98304:BTI0Mi+xyVgA/mwFSeY9j1dH8n/Ix9l3NeHI4B1S3OV:BTtMihCA/GJrH8nQx9lsHIhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764774448, "uuid": "bcb36cdb-7e68-41a6-b89e-8ccd8bcf92d7", "value": 6380304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764774448, "uuid": "04d9a064-36bd-43ea-98ac-bd18bb71d371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764774448, "uuid": "59688d42-40df-45fb-a2c2-82067cb767e9", "value": "ac0bf28ffe0578b31a0dc302e79e5656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3398a9c-d089-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764795082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795082, "uuid": "5a411336-4513-4793-9024-99917560553d", "comment": "Malware payload (Mirai)", "value": "3145bdbcde83feeebff58ff3a1bc32ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795082, "uuid": "2a72dec7-1216-45f1-ad6f-c9722e8f2c9c", "comment": "Malware payload (Mirai)", "value": "be4cfc2d1af46d739ff877d92920f62201a9b8289588046c4ce27897e1957881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795082, "uuid": "084baa7a-107c-4a3c-b62c-56aa1efa124b", "comment": "Malware payload (Mirai)", "value": "dbddb3ca89087c3eec492d9a6c1dc16a6d86206b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764795082, "uuid": "a2bb9786-ee1d-468e-9985-ad0cda6355ac", "comment": "Malware payload (Mirai)", "value": "4ecd9d61be5997f179bc2589b8db58bd95fb36e349e853a4953eeaf65197fec96a345bfb9944756bb4ac784c0ae078e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795082, "uuid": "2d2b2722-7e2f-40bf-9c8a-0547d8ed8405", "value": "T1B6A32A56F8828B22C5D512BEFA1E118D331317B8E3DE72129E205F2077C696B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795082, "uuid": "aa7fc029-490a-40c2-9b43-3f015a05a328", "value": "1536:dHnma2wfW/bfiGdLqHjC3PU45GjIZiY+garvVYTfuQr5MsQiAw60pZor7kw58YJ6:8FwfKfVdLLh4Y+garvmyw1pZorwwKo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764795082, "uuid": "cf4a68ad-f0c2-474d-ba62-459f3966b10c", "value": 101092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764795082, "uuid": "3e6c4bad-012e-44fa-9b2f-f9fbac70f287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764795082, "uuid": "bc047099-6a0a-45e7-9ddb-13f30540dce0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22d7cf5-d051-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764771082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771082, "uuid": "7ff510dd-9d79-4dbc-8bfc-7cc18e2faf4d", "comment": "Malware payload", "value": "a2e8dacfc1b8f6a0e2ca88e7d39fab37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771082, "uuid": "ceac2ede-bb27-4e55-b781-d301df9d4c9c", "comment": "Malware payload", "value": "bf3c791c373f11095551a1bff61312c22fd2da64f1fe5284253ca31602f6b97a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771082, "uuid": "59d1618c-bebc-41cc-9c4d-4a1565bfed4e", "comment": "Malware payload", "value": "a2b2b126444f2c39f36e3c402978d86c599cf2be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771082, "uuid": "194b02e1-527e-45b9-8751-faeb9b8952a8", "comment": "Malware payload", "value": "5040fb34398b2e4e1858c97eb57d7a53cbb6cb23262940510e79974820c93232e4ad64b38dde7375f2bd052500bf68e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771082, "uuid": "44e29818-89fc-4ee7-aaa4-56768e0246e5", "value": "T1ED04DC94E3D4F8E4C41B063FC71DFA1014AD2D306AA7507AE68E7F6A97312C1EDCA925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771082, "uuid": "28eeff6b-d1cb-4b8a-93b2-fdba3c05001f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771082, "uuid": "cdf83ca7-4787-4af9-b661-5794ce3dcfd3", "value": "1536:vGOQ1WvQmnmepFO/BB704/AlVFDAUQ4OJC:O91WYwtp0//I4IHFnZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764771082, "uuid": "06f9a085-4fa8-4eca-b7ca-6d0b64392c2f", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764771082, "uuid": "33e7384e-5403-40fb-98f2-f47c70d420a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771082, "uuid": "73c74b7a-fb39-4754-9d43-f18e75371039", "value": "avast_free_antivirus_setup_online.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6367928-d061-11f0-a129-42010a9c0007", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1764777907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764777907, "uuid": "9070fcdb-18b7-4950-b357-7b0296661cb2", "comment": "Malware payload (CrimsonRAT)", "value": "2390299115599866cfe0f40b4596ea89", "object_relation": "md5", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764777907, "uuid": "0d1f2a9d-a828-4908-9a50-20a90bcc1d9d", "comment": "Malware payload (CrimsonRAT)", "value": "bfd3cee0ef2eb54478550e422a2072d8d2125b0588f27930fa13e6f9de998aca", "object_relation": "sha256", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764777907, "uuid": "450e5c41-cebb-4339-9519-6866fce58b9c", "comment": "Malware payload (CrimsonRAT)", "value": "8a4818ca3085a280c7840550d4e56383f1806881", "object_relation": "sha1", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764777907, "uuid": "a08e9ad7-1f10-4437-bd7a-b45aa69d34c9", "comment": "Malware payload (CrimsonRAT)", "value": "b3389c7302ff69b94fc5a03b35ae1b38028da51fcfa461d82f866e17948ab3be769b3c50cb7675ee108d38d1b796d602", "object_relation": "sha3-384", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764777907, "uuid": "9beee086-4336-432b-836b-97343e0f4028", "value": "T166C6331C12D2E2B2E7E6D630EA92D6374B3CFA158F548792353C20FB8EA955447740EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764777907, "uuid": "22bdf867-0495-4857-9087-b0f61bf24824", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764777907, "uuid": "a71a3644-2ec7-4615-b6cc-8c3d3f7cd519", "value": "393216:1oGreqUHWkHTPZxledaEXPEpuHCkyn/HnrPGYf:1oGyqUXxxDEziTfrPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764777907, "uuid": "f156f994-2311-45e9-a293-1e6d295cb4b8", "value": 12601700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764777907, "uuid": "1b10459a-65a8-4e41-887b-2d8e33d58d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764777907, "uuid": "fddcb562-692b-424a-97e5-b49fee0ad77c", "value": "2390299115599866CFE0F40B4596EA89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbe3022-d012-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764744043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744043, "uuid": "3b8ba27e-140d-4d0e-95a8-975fe578079f", "comment": "Malware payload (Mirai)", "value": "9061bdb52155f07e9f0c328b0ba342d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744043, "uuid": "c9797295-562f-4c5f-ae91-8185538c2445", "comment": "Malware payload (Mirai)", "value": "bff537f14b3357cd2892416e09a6fead9688903e070dae2ae335661ba6e42f17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744043, "uuid": "46c5c548-c084-4122-a1eb-8359209e7dc2", "comment": "Malware payload (Mirai)", "value": "0827b6fa6132c90f28bcd564082c8c228d7589ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744043, "uuid": "c155744e-7216-492e-be54-94234cb8a288", "comment": "Malware payload (Mirai)", "value": "cccd4b0214c7f30cfd00b8303534e97425b291e74f35b5b8e5fccc5dc193f56ebc4b23b5fd9e6c5760e92a01971eedbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744043, "uuid": "2d2ef275-4238-4956-a20a-47e54cfa82af", "value": "T1D283F81AA9819F01D4C335BAFB9F815933136FBCE3FA7101D920AF64278A5DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744043, "uuid": "fc252e5f-da31-4180-9d49-2a2669954fc3", "value": "1536:eynSHJap45hMrC0R7VLx0aeNB2MA3N/mSl6o9oiOOmFMYZuBZ9YyBLoCub:KJap4zMrCchLx0aeNB2MAVgOmFMYsBHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764744043, "uuid": "44be612a-49c0-402d-849e-6057f272a387", "value": 86280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764744043, "uuid": "4d975335-1f4d-4c56-980d-0de515aca2f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744043, "uuid": "2e1e3ba0-0563-457c-a93e-528359f3d68e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ba39d3-d096-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764800728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800728, "uuid": "28d20d94-b4e0-4448-b6ba-3dc90b88efb4", "comment": "Malware payload (Mirai)", "value": "fb6010ebb5d73042e086b171ea615f97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800728, "uuid": "e3c2fbf0-750f-4b9e-a14c-5d0ebc4d97c0", "comment": "Malware payload (Mirai)", "value": "c0b7627193d16a85807e9fc1b32faad5ed8f346fadde531461a5578ec4fd3495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800728, "uuid": "0a672891-3584-46cc-a60e-3a9e5fa38fe5", "comment": "Malware payload (Mirai)", "value": "0dc40a50d7ded00a541deb1010fabbb1ce603d62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800728, "uuid": "4ad8742d-b8f3-4107-be01-4da945667bd0", "comment": "Malware payload (Mirai)", "value": "c1ad3fcd76699ac38109feee619bf950b74d17216cfd69b678a157bbe8d04b6636f4fb8f315120677c404e0612c0fb16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800728, "uuid": "f2cb5648-7be2-4b74-9679-978eb67b557d", "value": "T11FC3F80ABF110FF7D86FCD3706A90B0625CC555B22A57B3A3634C928F54B65B1AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800728, "uuid": "afa79138-456c-4a03-b77b-ec3079ddaa8b", "value": "1536:ZPvZHT+DemrUy2+32vfjQJXpi7Oi97ZrnqAwg0tS547+ZSvmTei:ZXZHT+UFMJXy97M75vmTei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764800728, "uuid": "b03d6a59-c383-4211-b7f0-55680ce7666b", "value": 122316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764800728, "uuid": "20b7f4d1-f135-4853-a3e3-7bd1fe6221eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800728, "uuid": "fd910240-3f9a-461f-a1a8-6a4dcb768fe4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe41962-d055-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764772689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772689, "uuid": "36d74b20-38c7-4606-b5bf-824abf9fc368", "comment": "Malware payload (Vidar)", "value": "ae47f697ea4e4ee3e7cfab1549239dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772689, "uuid": "c19eaaad-894a-4499-8f2c-32ebb6f86a52", "comment": "Malware payload (Vidar)", "value": "c0edb33c4fb4b0e28d56f890e9428efd96b3d31b1bdb94e43136f44db7f6eb19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772689, "uuid": "e043b873-7d58-423c-99fb-16cad977e5d6", "comment": "Malware payload (Vidar)", "value": "264ab72472aec9025aba6f2fc1930b3d3fb6b35c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772689, "uuid": "42c831e7-8b2e-4d16-9f37-da00cc776d49", "comment": "Malware payload (Vidar)", "value": "2e5a55be3d32d595b8426cdec985b2d4c52d1ce0c55fd45d71af101dae959174fde368c0b0b0867f6437c13886d66454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772689, "uuid": "03a3f195-f1c7-49fd-8ea4-1a892259d731", "value": "T1CEE623D63ED6E1ACC0D38F303286478871F2BE8955AE5B1D37C675072670E8B4DCAA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772689, "uuid": "9b7674de-1c66-4679-86b4-95fd2ff41f17", "value": "da4b2b686240b914efa680eaf6606f23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772689, "uuid": "0bb5a6e2-9521-4bd4-a62c-8569a122c4b6", "value": "393216:nQx6lcdYmI8pPlLXqRw57lQft1LdMXDIPJ52gWWFY:9lcVI8lFqiplHDIKgWWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772689, "uuid": "a2d87419-cad6-4e1e-90ec-5a837c87e3bd", "value": 15182848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772689, "uuid": "97d83b3f-1cad-49ee-b7fa-83fd30161476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772689, "uuid": "6856bc76-0c44-41c9-af58-27d10c2022d3", "value": "ValorantHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9c2c75-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764782184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782184, "uuid": "be30af18-ae4a-4fd1-ac01-c6ba92a712ee", "comment": "Malware payload", "value": "d8acae8fc02102162d7656252551d1fc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782184, "uuid": "a1848813-7333-47d9-a523-d7798fb09753", "comment": "Malware payload", "value": "c0f05be91780c67dde68bfe1c0b6ba5d69a813cfa77672d42ff3367612fabcca", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782184, "uuid": "eb0d3b7f-3a0d-4a4a-872b-78fb3db0cca6", "comment": "Malware payload", "value": "71284eec3064119a160aed697838def681ad0064", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782184, "uuid": "413e4b8f-5c7c-4204-a877-3c1ae5e3ca08", "comment": "Malware payload", "value": "68a54c1319ace179cb8f576d4e23ecad165359be272bc803a156be09b669c2ae1016f3881c635e6651225c2bec5c7fc6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782184, "uuid": "3879c086-38e7-40a9-ba5d-cab876a1e465", "value": "T145C66B0BA7025F26C5AF933688F703557331AE86BF4397470246B86EBC732D19B952C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782184, "uuid": "bfebfbc5-22d3-40cb-9a07-bd014746a681", "value": "98304:0aDHJ9Rt5GCRPBqSYdemMqjIz6DbVe3lkOw156qFsId2ofrjabm:0eVnpqSYqkSqag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764782184, "uuid": "65a0df7d-6a76-4d2c-92ab-9d17bd79e16a", "value": 11976694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764782184, "uuid": "b809eee9-8e36-41a4-8a64-183a92ca4342", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782184, "uuid": "c9209b86-ffb0-4b19-9d21-2ed44a1f19ad", "value": "upload_2594bca12150e930de32ab22451f4952.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08186a0-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793789, "uuid": "a85d5cbd-955e-46a9-87e8-a232ee1bc81b", "comment": "Malware payload (Mirai)", "value": "b88bb30e62404dce32c2584f0e037cd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793789, "uuid": "c1578894-8792-495c-b0ca-66d7d2b90ee4", "comment": "Malware payload (Mirai)", "value": "c1f986b48e1d56d6a39d21fbc618411713d0d24a97b96f73c0fff554d271e86d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793789, "uuid": "e24c8680-8ee5-40c5-80df-29feea4e0751", "comment": "Malware payload (Mirai)", "value": "a0fb99cb67c650b15a4d0f2d6e0dac10d86035e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793789, "uuid": "5c63fa5c-272e-4af4-af02-3de7108e5e80", "comment": "Malware payload (Mirai)", "value": "9d81df9be085e7c7c72c618ecaeca91c237ef3c6d01cef14edbf862f3974c436f8073cf2365b5de10aa8d61348692f42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793789, "uuid": "964ad70d-c4d2-4fff-9780-54caabb63686", "value": "T18313F116C316B9A0D27FAE3BBB548EC2B675F3C8876B32050201A3755C8B7394578B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793789, "uuid": "aade7e74-2ee6-4eff-9e2a-97156bf8b1d0", "value": "768:aVHm6ewgSMl8YHoD0aAXakCxo5jAoPFxzgEhXlUeDTs3UozF:aVG6ewgSsnHI0aAXakFmoPFxTh1OzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793789, "uuid": "1afcb9fa-3ef9-4ac1-a868-b90af6ac9735", "value": 43420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793789, "uuid": "000b59f2-45f0-4eb7-8525-6b1713e71886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793789, "uuid": "b827d6f9-5907-4d55-937c-baa93871a63f", "value": "zerobotv9.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666de26a-d07e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764790175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790175, "uuid": "b0448773-16ad-40dc-803d-577e50df5b9f", "comment": "Malware payload", "value": "c75dc1096421f34fb07209fab507facf", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790175, "uuid": "843c475c-ab2f-45a6-8995-5827751bf436", "comment": "Malware payload", "value": "c29066f832baeeb36abe9415dba3b9f2d6b95030caad2fda17390f412c674e6e", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790175, "uuid": "6a5b95c8-bf68-4886-8bd0-1cdc85438272", "comment": "Malware payload", "value": "21b98f5c2e88ebb6df1a4e62d59b968bc7bc7836", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790175, "uuid": "b4bf9386-2d44-4c6f-9ca0-adb4eeff6da8", "comment": "Malware payload", "value": "64c5ef12ac6870fcfcd227b80fbd589067f06ad928443cf9bc8652c321e1da9d1c8e456c5bf03361c2652c6c6e85b047", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790175, "uuid": "fd186b55-147b-4313-b86b-de1428516a2a", "value": "T150C3022CA9446C4EED87BBBCD14829F1535EAB9844556F1F51C1E2CE4F501DBA38C2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790175, "uuid": "3e6a7684-0187-4a5e-b4d9-ed74cf6db83f", "value": "3072:gFT4OgGr7QNiNaIVqeJelwvxaKDWOmbcTP5vWnNpWA71dYDTn:2zLrcNicIpjvxdOSP5vWnNodH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790175, "uuid": "0da5470a-9481-445f-9252-bc457be60089", "value": 125593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790175, "uuid": "2d6e1238-eb29-41db-a04f-85cf4e0c04f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790175, "uuid": "e364130c-e26f-46c5-bae4-8e200a697417", "value": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u041124 \u0441 8 \u043f\u043e 14 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2025.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e7c654-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749561, "uuid": "0f498ff6-8c68-45cb-9b3f-c9356fffdf5e", "comment": "Malware payload", "value": "81b5a8aa98b50e77b861854e76944e08", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749561, "uuid": "510d5105-2834-453c-8291-a9d12938cf44", "comment": "Malware payload", "value": "c2f6cfa7ffb357d220970264daa5182226770d640c4369a56acacb08a523c4e7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749561, "uuid": "e519657a-97f5-4767-8c57-0ab69d0e128a", "comment": "Malware payload", "value": "21696e4e5a00de57290bfad0aebba25f7c4da494", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749561, "uuid": "c94c05a4-00ad-49f3-a94f-3686f277d676", "comment": "Malware payload", "value": "a611529a4b1178bba7c48d64ccd03b4e61604a36e0dd07b80753fd304d125bcf8cc2d07ccc0be392da1cc520faf4a3f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749561, "uuid": "e4ee0677-0589-492f-844f-ca8c1be4b36e", "value": "T16F853358A3FA8FF2F8EECC746367AA48612844F900FD757B53E23C83941464949E51AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749561, "uuid": "c28ddaa8-f76c-49b0-a87c-bf7d65488619", "value": "49152:4sVrIwFNvkslp7SYbHaAg531mfKPqtBNy:PFIsr1SYbJg5FbitBNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749561, "uuid": "8ed71919-15e8-4187-8bc0-8eeedf4e7c09", "value": 1733203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749561, "uuid": "73872f34-651f-48fd-8f62-d659e7aa8fcb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749561, "uuid": "d7da5606-9041-42ac-862b-daf717cd31b5", "value": "pl-miner.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e549c94-d004-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737736, "uuid": "b306fcd6-e35f-4846-b537-6d37e6599c73", "comment": "Malware payload (Mirai)", "value": "57f8f2894b5901423d379208322e0502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737736, "uuid": "c98447f2-af6e-465a-b016-3f6b3af74495", "comment": "Malware payload (Mirai)", "value": "c41fae2004dbb2fc4267de3bd5841f0c6555ce2e4d9d2a741d24f34b50303aa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737736, "uuid": "efcb4656-332e-4ad4-a618-39faf232325f", "comment": "Malware payload (Mirai)", "value": "0b3f1f6ba4c204da6e490dfc7e879cbc525cc2e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737736, "uuid": "0f98e4bc-8e00-460a-a738-46fde5425014", "comment": "Malware payload (Mirai)", "value": "b50edfc51cf0e49b6d6aa9980ac8636f059072a650601afad03e3384d75f88c133b0de56bfd81f8581c1d3dffcedc3b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737736, "uuid": "b27ba66c-9026-42ca-8026-a41e6d5c2683", "value": "T16354E852EA416EBBC00DCE30051F878922AD849D43FB577BB278C55E7B8EA0D6AC7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737736, "uuid": "04d8ded2-90c2-40c0-8a85-01fe1b20f2a9", "value": "6144:uEt/rKEAJ9zw27FVon9vIQZE0y6iyq1WyUeUk3cNJRIyybW:uENuEyNUk3cNJPybW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737736, "uuid": "86983db1-a45b-4c7d-9dda-2d7614c63496", "value": 291280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737736, "uuid": "3b7c701e-3083-469f-b204-d05480b6f509", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737736, "uuid": "1e0bf87b-e30e-48ac-83c2-f248076d89db", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64f00a3-cfe6-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1764725106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764725106, "uuid": "07b42b01-2097-4632-b11e-02382e7421ef", "comment": "Malware payload (NanoCore)", "value": "e5e14f102cb4dd3286abec8355d14dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764725106, "uuid": "0373aa33-5048-47e7-8274-70efb9051cd2", "comment": "Malware payload (NanoCore)", "value": "c430256840a5795787ab14b715a12c2ae98276425d418040c178d85c988de1f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764725106, "uuid": "88a395e1-a30e-4410-8edb-5d6edbc18915", "comment": "Malware payload (NanoCore)", "value": "36be4acf4ebc50e69e40fc7fac498e5fb5c64149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764725106, "uuid": "e1dc9ee2-5ab3-4dac-a19c-9722982b9e02", "comment": "Malware payload (NanoCore)", "value": "cfcaa1600a9cec8c40962ff0894cd7d375befa5d54065db6eada0ad27fecfcab88f13cb1e92279f85f0cf39ef45ec5c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764725106, "uuid": "65428ae5-f8ca-46c5-91cb-508a6e84dc02", "value": "T17B05E12A6B95A416CA70DBB62B9BE37313645DD8DA10C312BFE0FF9B35B6B1C45400D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764725106, "uuid": "58ee6993-25c8-4b5c-ae59-c552cb996b31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764725106, "uuid": "29d212ea-7eb5-4ef6-9b9e-0f3623d26dfa", "value": "12288:Cf2as2HO0qn8QrPHHbTmaUwQJe7bfSRJXbf:42RuDQrPbTmavT7mDXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764725106, "uuid": "48f9e2de-af89-4a90-ba72-3d552972ae9e", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764725106, "uuid": "589667d3-60cd-492b-9e91-186f820e7280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764725106, "uuid": "69197d05-96fa-4909-88c4-5027af9b5102", "value": "Rs4459270000000000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9887273-d003-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737566, "uuid": "60bdd32a-8613-42bd-b33a-d71a9db74bd6", "comment": "Malware payload (Mirai)", "value": "0e7247a42dd8d1776795d62ae851893d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737566, "uuid": "26ea8b43-c1d4-4f38-bd28-b03cd1bc2358", "comment": "Malware payload (Mirai)", "value": "c48e7e301c663a0edc7a4372d7e1fcf837c0a5c4a56bfc1f8c2c7e2e2b7ccf8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737566, "uuid": "8088d615-ed38-4ec7-84b2-968f5b524dd2", "comment": "Malware payload (Mirai)", "value": "5f9bfb5631c70bda7c03ab396e786ea796edc9df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737566, "uuid": "2e1ea798-30d9-4938-ac42-2d0f2a8642d7", "comment": "Malware payload (Mirai)", "value": "6bd3170e13a6b9665addf4b708041d225c65e3455e94fefe967e5eb40b79926be16c7794360bc04911b328ae414745e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737566, "uuid": "481db634-bc7f-475a-a1c1-adc2de26400f", "value": "T10DC3F845FC905B17CAD211BBFB5E428D7B2B1768D3EE720399256F20378B56B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737566, "uuid": "ce3f0cd2-34c0-4e3f-9d97-695444c87ab5", "value": "1536:8fitq+5/nsqfTqw2tE/Hk4VSdYmTwj2XzBIIaOVJ+ol9Vwyw/1IB49Z8lhZdycyt:8fEyqrqwhE4SFcj2XzoOJLUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737566, "uuid": "2ec78529-33e1-4136-8bf3-967be8fdcc18", "value": 129632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737566, "uuid": "2eeafa5a-73e1-4bfc-baf5-c241a4ca773d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737566, "uuid": "349eecb6-5137-4512-bb3e-4e67d462cd2b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34c84d1-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793793, "uuid": "24ebd461-7f72-42ac-a4fa-74431251e175", "comment": "Malware payload (Mirai)", "value": "1c417eb4e259a960083ccc678a9a18b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793793, "uuid": "16bd9edf-ee6a-49d0-881d-b4df72773a2e", "comment": "Malware payload (Mirai)", "value": "c4c160602e5d637c6367908715b4dd4a4423ddf007d53a5db132663eb95bc6dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793793, "uuid": "af62843c-522b-4842-8f18-8264a47d364b", "comment": "Malware payload (Mirai)", "value": "2c18e675fc0f3fcb3ddda5e42cb9733278100dce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793793, "uuid": "58e564a2-d0e6-41b6-a1e6-9e155e233fb1", "comment": "Malware payload (Mirai)", "value": "7bab9d66c0d4547f6c8f0e241b82b891421dee1f308e23286214ea8598bc0ae52287346cda5094a07ef2669ea83444d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793793, "uuid": "69a245db-53f9-482c-9753-5346cd183434", "value": "T1F013F136D6510ED7FA6C8FFA3BF48B803FD11BEA3326C9D11146D71069A542A93E1889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793793, "uuid": "00ef13ae-b6ee-4fbb-877c-dc3181a49491", "value": "768:RtskdA21MB/cTAq5k/AC7pl/JKnMbBLkjJ8r1lXcSFiGP2k05RbVF4uVcqgw09F:RGy0ZFqibKMhk9cbc1GVKJf4u+qgw09F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793793, "uuid": "5fa8158e-6d62-485b-8bef-89342fb27bda", "value": 41576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793793, "uuid": "9c5275e1-fd14-4e02-8f34-b83049d5ba1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793793, "uuid": "82cd2688-d90b-4f4a-9720-147d6871d46e", "value": "zerobotv9.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f052b6-d06f-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764783914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783914, "uuid": "f591461c-c3fc-4602-ba27-e4cca61dbe38", "comment": "Malware payload (ValleyRAT)", "value": "001fafdb776986e515e17304d2c23cca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783914, "uuid": "b8f3ffea-461b-4df1-bce2-8f8b21aa2315", "comment": "Malware payload (ValleyRAT)", "value": "c4d03259a2f566f1f467d6398f3bfd0d7337b62779403d477e9e92da39dde12b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783914, "uuid": "eaec3e2b-3d85-4cc6-b838-117d85488599", "comment": "Malware payload (ValleyRAT)", "value": "5812801983cc6e230281eef34e06ea54f778f450", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783914, "uuid": "575dfcb0-0ad6-4a06-be1d-a284a184bc67", "comment": "Malware payload (ValleyRAT)", "value": "d11aed580eef6bc9699accade8a7e054ad113da81eb3a977c9d8078baae0f2197014e42c1e077ecb18cc91e034f35a41", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783914, "uuid": "09fd8c94-6535-45a4-9286-0513329d5893", "value": "T1C766AF57382C047EF0B9C131E68F5A78E52D7DE12B9B009BB09DBE1C267164216CF7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783914, "uuid": "31922783-be67-48c7-9f45-d6171ab1facc", "value": "6ac79776e35eebb3a9d8efb53b449e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783914, "uuid": "e09947e9-1eaf-47f6-ac7e-f5d7825fb145", "value": "196608:3qwxb3KMr1iwKpkQCX+4TNAg4O7NADtV6v+7S+EUWT:rxb3KMpiwW4Tn7kbWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764783914, "uuid": "d295a9a9-8f2f-499a-80a9-cbcfe215ff55", "value": 6837992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764783914, "uuid": "36480ecb-1c8e-4fe2-a5f6-275484aead42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783914, "uuid": "0d4f2aaf-d737-4f84-a045-e692e421a66f", "value": "001FAFDB776986E515E17304D2C23CCA.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec8982f-cff9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764733039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764733039, "uuid": "80dca91b-f2db-4abb-b3b5-fc2dbd8b6b41", "comment": "Malware payload (Mirai)", "value": "9e6c25745c5d63636788c12d5fc32339", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764733039, "uuid": "2541bf87-1e50-4d46-92aa-2e0ade2c3354", "comment": "Malware payload (Mirai)", "value": "c541e889ba556bac37bd0359aeb24224d15363228f213b4acb87073ea6f56713", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764733039, "uuid": "227cd1dc-9f6b-470d-ba35-b8842d859b8c", "comment": "Malware payload (Mirai)", "value": "6c7877f56a94c571af9d3f4fc965d230d08535d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764733039, "uuid": "2a4431a1-1f83-4f43-9cb3-db5fb6d63ca8", "comment": "Malware payload (Mirai)", "value": "417ec15d912928f8c28f0aee9a6fd1b59a8f689076580f1c2e02ceeb88f8a2395076df261c643ebddddbd017edb48634", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764733039, "uuid": "eeef616c-980f-4aed-8bb4-11bd426e5ed5", "value": "T1A4B3AEDBF78714A0C8624AF007C35B9E2E273211CE6BD9E7AC1E3A39597A1DB05167C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764733039, "uuid": "cd13380f-c63e-40d8-83c7-7b7712bfbfb1", "value": "1536:XMxuUkRt3yT+EMkbSTJNqMJCL37rl/uM53XlekeQJPrgVMT/LWA2:8NkRt3ynMk2XJCjnZuCXzeQJPrg2qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764733039, "uuid": "1b21ab29-fa45-4e96-bf61-114e0a85032b", "value": 116340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764733039, "uuid": "442ae7b8-97eb-4ed3-91aa-bfe8294e63a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764733039, "uuid": "6f8fc81c-3953-4832-92a9-e71139dd714e", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4e43ef-d05c-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764775667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775667, "uuid": "6e1e2991-eb27-4048-bf4a-ceeea6a49ffa", "comment": "Malware payload (RustyStealer)", "value": "720804a1e38299c4ffa1e67a966c8e74", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775667, "uuid": "3b2d5b17-4134-4300-9377-56533f08ea9e", "comment": "Malware payload (RustyStealer)", "value": "c5b2b190d18f40051c5697746b21252cf14894ba10ae6e3e007e6f5ed4b31dfe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775667, "uuid": "f83bb581-088b-4cc8-883c-70c25024f49d", "comment": "Malware payload (RustyStealer)", "value": "cea752f898cf77bd63d7ed21815746e7abf615b6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764775667, "uuid": "71eaf4dd-b71f-4beb-9bde-ef3bd681e72d", "comment": "Malware payload (RustyStealer)", "value": "83cbd4883a523d078401e01e6dbfa0eb4ee4a0c10ff525f9ffa40386de96319ce01e1e23a2b475de912a8a2a4ee0b57b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775667, "uuid": "6106dc27-01ac-4b91-8539-d5d8dd5b5a7a", "value": "T10EC49E97F1A26DB8D227C0388217F17B7A3A75852522BF775AA4C9306F62FC12F09705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775667, "uuid": "0917d09e-5a0a-4886-b8f5-4d9e975baef4", "value": "4d0baad4973da8341e14b651526cb4db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775667, "uuid": "65879124-90be-4093-829c-b995e208869c", "value": "6144:98QWm3cB4z1ehvGivs8KU54R+14pxyvOIDOSBrXzsiXsxcoactl+mp/cMoZU:9jyQi0K4pxIvlX8VZnBcMoZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764775667, "uuid": "3207fe18-98ae-47a8-aeda-bdd8b642f407", "value": 571043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764775667, "uuid": "a97dd901-2c88-44e8-b4cf-b721a05f4dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764775667, "uuid": "5e8a02ed-1f8b-4859-aa43-3a6319906d50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c476f035-d048-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1764767140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767140, "uuid": "1d6a5fae-a4ab-4563-a1bf-563634438ccc", "comment": "Malware payload (DarkTortilla)", "value": "3707d76e3f3f2b2d9c262d846ce84ea0", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767140, "uuid": "190ebd7f-9933-435a-b7a2-3373691486db", "comment": "Malware payload (DarkTortilla)", "value": "c657660bce96a5fadf3390883849fc322b606f0a0c497fd639c7a49ecd920c15", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767140, "uuid": "1666e112-094c-449a-9222-a573869108af", "comment": "Malware payload (DarkTortilla)", "value": "8e4360d09aad48470f0d08b43190540058e5d8ac", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767140, "uuid": "6ef957a6-9028-4877-a9d7-fda25fda9af9", "comment": "Malware payload (DarkTortilla)", "value": "1c627e33c0d83a99623ca5d80b36beda87525a585e810c277839fed607f7bdaa6f5da29f0e6676f53d4a27ce4ac84c16", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767140, "uuid": "a1aa4c81-bd3c-488f-96d7-86e587a63d19", "value": "T190B48B1653A85F51E57F9B7690A1810457F2BC02CF37E7CE6E886CE93D21B8289D2327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767140, "uuid": "1a20c2e1-0da5-463b-b5fc-f843ac0cec20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767140, "uuid": "efe27749-2f60-4a7b-afa7-3bcaa95fdfe2", "value": "12288:iygF1E5NDdlTHJS9C6pRwjdbuzRiMILAudBWr0VI:iJkNDTTHJGBp2jEjCAagaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767140, "uuid": "ec712ae9-0fa2-4126-9038-49e7bdbfee38", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767140, "uuid": "c136929e-3260-43a6-b1ad-188491261f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767140, "uuid": "4c539d64-63ef-451d-ba6e-dcaa89f6f042", "value": "ZAMOWIEN.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b46949a-d07e-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764790183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790183, "uuid": "206baa48-5a81-4bcc-8757-e72cc1d22385", "comment": "Malware payload (SnakeKeylogger)", "value": "f0f219d88230f5963806ce04d7e1acf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790183, "uuid": "859bc70d-d270-41f5-83b1-d5aaf5b85baf", "comment": "Malware payload (SnakeKeylogger)", "value": "c657d5a1069f9aacf50a01f859e4301761337d5e45601278597ec5f3cd1c8e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790183, "uuid": "3a77ee5a-a982-48d9-b5ba-9f2400ea8325", "comment": "Malware payload (SnakeKeylogger)", "value": "a96a54c71ac1d2031fc9ef5cc696ef09f4c81c7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790183, "uuid": "a813e120-87d5-4ade-b298-0020da14d3db", "comment": "Malware payload (SnakeKeylogger)", "value": "0caa5656f33be344aa99f18809662bc6bbf14a2823c381cba42a7c290720523c5ac8c991ba0824c4d1c59cd5a8a1af6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790183, "uuid": "26f93f0b-51af-4e0e-a78f-35e8e170bf34", "value": "T12FF412A82A49D603C9516BB006B2F974B7B94EC6D910D323EFD9ADEFB9B6F100D40147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790183, "uuid": "dc8932f3-ff83-4b05-995d-633e58f63154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790183, "uuid": "bed2b1a8-f72e-45c2-a392-9cee31ad1a64", "value": "12288:Pkgkq/KTn2as2HLsxDHyGXXq86vUtFmHx+SHQ3SIFqPL91OSS80YwdRmFLQYguWA:PkBn2RuLsxDHyA73mHNwiIFmL9rl0Ywk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790183, "uuid": "3d8f76fd-cfb5-407a-ad8b-1ced9170afe8", "value": 781320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790183, "uuid": "13587666-79b8-4d03-b937-72b02560ac4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790183, "uuid": "49c718bb-9235-4f2f-ad10-4555a34cc9ce", "value": "Th\u00f4ng b\u00e1o c\u1ee7a H\u0110\u0110T C\u00f4ng ty vi ph\u1ea1m thu\u1ebf qu\u00e1 m\u1ee9c Th\u00f4ng b\u00e1o s\u1ed1 10964001 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5032e4c-d00b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764741022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741022, "uuid": "0a17ca65-dd6b-411b-b827-dddba119663b", "comment": "Malware payload (Mirai)", "value": "0da9a19d1eb130a9e36dff9ede17d4ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741022, "uuid": "02c98e65-e280-4972-9710-c83accdbb367", "comment": "Malware payload (Mirai)", "value": "c6eceb63ef90c43edcf884bb37d6e1d1f324cb4d716e14df9e17152608f19219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741022, "uuid": "d0197f30-9985-4eec-8a01-973e499c7489", "comment": "Malware payload (Mirai)", "value": "62d857bedd538d08fc28dfa014d940ca8d240297", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741022, "uuid": "113ea4cd-e91e-4286-ab9c-aeb83f7d1814", "comment": "Malware payload (Mirai)", "value": "e9c87228b5b94b5a0c0abf54fd3882201e79839951578cf9a49d48cb324ece06a146c7020afa6ace6d25c7fb47128d5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741022, "uuid": "405ccce9-0c90-4088-9119-fa1ea97ecf7a", "value": "T1A7F37D06F692D0F2E59302B38057C7A55734CE310366CE06FB586E39BD326099E5B7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741022, "uuid": "cbf8d027-496c-4bc0-9590-858050905228", "value": "3072:7Yz7GgGqZtXToykc7JCSkDVaPsp9tilM7WTF8aIitFybjSlzemXC:Uz7GibkcksGilua7F2WdemXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764741022, "uuid": "2f2198e0-117d-4d43-b49f-2315e2d8ba76", "value": 167256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764741022, "uuid": "5bfd270a-43fe-4ea6-899a-49ee3bdcd8ac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741022, "uuid": "3eb2d731-00de-4340-8bbc-775c63815f3e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cfbf54-d09e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764804047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804047, "uuid": "564128c5-fc1b-4e93-b6e4-d4c16374feb1", "comment": "Malware payload (Mirai)", "value": "76935d7290720a6c895098a8f1342c1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804047, "uuid": "5a1978ec-df8e-4546-8782-0d1e32331701", "comment": "Malware payload (Mirai)", "value": "c7608c4ce35682e5958130b4736cdec1117aa97cbb88ddce4f91c1736722308d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804047, "uuid": "d39c70ed-15b5-4afb-980a-2b69ccf80242", "comment": "Malware payload (Mirai)", "value": "a2396f7e8a8c97ce732f6cc1453c67811b86b086", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804047, "uuid": "bc954edf-3cd2-4139-b6ed-bc8d695f824a", "comment": "Malware payload (Mirai)", "value": "77821723abda30264429c47a78013fb868afba82900be0df8c133e6f0aa0c079e69ae8fa6f84110b24ea5db7ad88544f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804047, "uuid": "7edb3ec7-20a0-40aa-8926-357ae282b1cc", "value": "T17EF32945FC41DB27C9C265BBFB4E438D372617A8D2EEB2039D259F213B9B55A0E3A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804047, "uuid": "620b6e7f-a195-4426-9ad0-428dfa5b90aa", "value": "3072:o4FxjC7YuY2o8zQ44Qp5XY2jOns/7re8EcL:XxjC7Ydp4Q44YXY2is3+cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764804047, "uuid": "a4ff5c19-62f0-445a-abd8-1d64d27bfe3f", "value": 162928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764804047, "uuid": "da4c3b9a-6667-4d7f-9e36-618d0d2089c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804047, "uuid": "bc10f2a8-64fe-4df5-8abd-925398585dea", "value": "gang.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59295ae0-d00e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764742049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742049, "uuid": "d31b068f-cd75-414b-9fe2-95aebdaae585", "comment": "Malware payload (Mirai)", "value": "e71bf9f520bc2c364a7356ba44e81dd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742049, "uuid": "3f29c49b-f4d0-4b70-88d2-5dae4ff6cc8d", "comment": "Malware payload (Mirai)", "value": "c76e99ca65870948ce6dd077d0967d8bf717998af4270038509a7c64faf4f4d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742049, "uuid": "f8af4dd6-7fa6-4d28-8e39-4c1487bb1c74", "comment": "Malware payload (Mirai)", "value": "d2d28e9b1103c2b2e204e32ee334eb40113d9bb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764742049, "uuid": "5bd8a060-3629-42e9-81c9-ab60ccb3ec7c", "comment": "Malware payload (Mirai)", "value": "a60356f71962b5cd69da8d24175174a4f1567ab1e29b29f3d2a532a9ebebab8104943015bfeac0527e835e6f95a2081e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742049, "uuid": "d600ef8c-8aac-48b5-97af-be3e4a2b0dfd", "value": "T1C7D3CFA7F78314E1C85307F407CB5FDD2E5322825F6B99E76C6E653B68B60CA4502B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742049, "uuid": "8dcc3da7-98ea-4dd8-998c-210a8c2db491", "value": "1536:6pgAmz2Xf5rmZMIOtNWzP6oBLtHLOJfp8lPjd6tvKgN/O/LWN:6pgTe5TaPfxr4fp8D6tvKgNGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764742049, "uuid": "36ac71c1-cc3e-4d51-9b3f-686ab9e1d4a7", "value": 140940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764742049, "uuid": "348edb6f-2944-4cae-a0e7-5b14a7b5fdaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764742049, "uuid": "cb1a0e66-de8f-4230-b4b5-873a264005e5", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8018e113-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736531, "uuid": "264731b5-808e-44da-9344-77dc11fd3e81", "comment": "Malware payload (Mirai)", "value": "4e246c2fd6e59b528ffdafe29e025252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736531, "uuid": "a97239ac-e7ab-410a-b219-7aaeb61d05e3", "comment": "Malware payload (Mirai)", "value": "c7b71374e92be42cbf48fc4b0fcbf3d02bccea1d860e8c56c96a0586691b5f4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736531, "uuid": "a8d0dac4-2c6f-48c5-9269-e816244655aa", "comment": "Malware payload (Mirai)", "value": "69abe18dcd50ede3c903f54c1faf35efdee6bae4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736531, "uuid": "752f6fc7-9193-42d9-bbf0-eed6fd719213", "comment": "Malware payload (Mirai)", "value": "05c271a42e87996938d033385d77b2c45d0fe144ff5346b28bfcc3189f4de619f47d6999916437d89f503a07b153bb83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736531, "uuid": "d7c1a2b9-de09-4bbe-86ab-c636c67b2f40", "value": "T172C3123EEA341267E863F4DD44D7CA268A5769FFED0CCD73520F4A8158EA9097240BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736531, "uuid": "8b455af7-1da4-46b2-aeea-9a53039f2acd", "value": "3072:T1y0/ktL/sj+CpW+U92Sw9GtLa3ekR4ORtLsZ8F6/z8/532cndL48EY:hy0/u/f/32SwsAfNsUl2cndLEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736531, "uuid": "6e5a55f6-7bdb-4d13-90d8-76aefbb56202", "value": 118216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736531, "uuid": "41571647-cde5-480e-bf10-a7646c78b8a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736531, "uuid": "4402f60d-20b1-4897-8ec1-7d4c155132f9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bfe8d6-d054-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1764772160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772160, "uuid": "51cb0e22-cd3f-4d6d-a495-32fcd6d92bbf", "comment": "Malware payload (PhantomStealer)", "value": "17119215e673d5dcf6dd2659e48fd606", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772160, "uuid": "c48f1b01-c414-4d67-bad8-e7e285246a0f", "comment": "Malware payload (PhantomStealer)", "value": "c7ee957c09687f1d16b1062e052d0061d98405302c8718356e5a31a01ae04d46", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772160, "uuid": "c45d373c-b688-4f5d-8bd6-6ed257b8b640", "comment": "Malware payload (PhantomStealer)", "value": "e5f5e8a4c3f46d97b1dae90dd54a577eeb7c3e3c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772160, "uuid": "57b74380-c970-4cb0-9533-a9ed43458abe", "comment": "Malware payload (PhantomStealer)", "value": "d9e5f027f86f047109506086b47b7028a9b1f0f7a5494704be486481f4bcfcd572105d6ed56568bceeae1d481335b2f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772160, "uuid": "e61a1a26-9dcc-4417-82ac-8b1e937e1f51", "value": "T19BB45B20ED34067A0F471B99FCA90B62CAFD8609462650F5F6DE070E61065ECE3FE769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772160, "uuid": "deb5d169-8874-4457-a64a-1220bb0fcea0", "value": "6144:WuCtz/OVrPiRNHdSwxKPzrCl5KkF+4+K4P0Chu5oXgIPEBwBU4xgkVtXtRB1YkBW:9WOK00zqgiVvSdYDLJt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772160, "uuid": "e9954131-6eb1-4d40-9db1-e8e921b4060f", "value": 516715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772160, "uuid": "800583ec-282b-415e-82f0-7dce90300e2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772160, "uuid": "2ecbb04e-4191-4b13-be90-9af5e3565357", "value": "Payment_Confirmation 900865 Remittance_Copy_2024-12-03_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00c68b6-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1764749496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749496, "uuid": "c3658033-11a5-40bd-acd0-2b155f57cec5", "comment": "Malware payload (OffLoader)", "value": "7478878eb5f2bd92a947ce262c88f24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749496, "uuid": "69ebddfe-01ed-4e6e-af08-9a90a662c2cd", "comment": "Malware payload (OffLoader)", "value": "c80cf54414ea4ba9013eb3df6ebd9c851808ccd6830d0637fcd63e713b1c88cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749496, "uuid": "3bc61deb-013a-45ac-9e89-2ddf921809fa", "comment": "Malware payload (OffLoader)", "value": "602514bed972f0e7b08b434cf66bdb3bcf5b4465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749496, "uuid": "bd8b8d3e-99e7-4576-91ff-b828f11dd118", "comment": "Malware payload (OffLoader)", "value": "f02309e0ba0df5cfedb14809f942a9b67629320256bbb10ff3da02ebea80743c0aa6de9c3a5118f00a96e5fb7c3c193e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749496, "uuid": "de11745b-cffc-4fcb-947e-d1f791265c26", "value": "T1DC461237A38A673EF06A5A3B59B2D230593B7E51644E8CD697E4084CCF2E1A00D7F653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749496, "uuid": "789ac748-2170-4eef-91cd-cd43f0c0fd39", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749496, "uuid": "8b9478af-aa90-4417-9e4b-6e51f821fa02", "value": "98304:EN66BPLPeDsyQZpxcQ67sdi3kTAeLH5W0e/9bXEIEfbHxbum5FR9E:wpmDtQtcV1kDFe9pSbZ56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749496, "uuid": "8b83f620-278e-4960-97d2-a930505513f6", "value": 5691023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749496, "uuid": "7b8785de-1709-4030-a34c-b63f8731ae59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749496, "uuid": "c1949cd0-a733-4bd3-a508-83b68ee44878", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4faef6a-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793796, "uuid": "5e1a31e6-0557-449b-967e-16396dc318a3", "comment": "Malware payload (Mirai)", "value": "4c3be7b72b1090ad76eeb8d1c1210043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793796, "uuid": "731c2a51-556f-4960-a536-06bf86af5c98", "comment": "Malware payload (Mirai)", "value": "c8e8b627398ece071a3a148d6f38e46763dc534f9bfd967ebc8ac3479540111f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793796, "uuid": "6f5135ba-9868-42b9-99d4-f079fa174974", "comment": "Malware payload (Mirai)", "value": "570d1ed18a5a5d933f86d3bdab950ff6805b22ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793796, "uuid": "b7ddac43-6d30-4c3b-aba1-3ed5afe09b15", "comment": "Malware payload (Mirai)", "value": "672a8a3fec11a4e891ca5baf1c9f118e66eeae5f6b22fb66bed328d2b66fd839f0ac5e821e303b42fd1dfa5426f691e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793796, "uuid": "1ace2fe7-94fa-4588-adf2-a0b3d6e4c69e", "value": "T1336302603212549D96B00CE39C7E80F53BA03ABDF9F4A69373091D9FEDD715960745C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793796, "uuid": "3a84767b-9eb0-4275-a742-f63183b6144f", "value": "1536:+c0zoxsOw2RWZfdjS12Gk8xp6izLu0e0DUYvE:IzZ3PxJSJz1L5emUYvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793796, "uuid": "2fef8172-06f7-4487-a570-cd62a2860ae5", "value": 69316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793796, "uuid": "1bfd1935-3092-4d5b-9be4-4d2623c68e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793796, "uuid": "e86e4951-7bc6-4150-8467-a42515332b01", "value": "zerobotv9.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215d6ca0-cffe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735083, "uuid": "61eb3ccd-564e-48d1-9229-157b1969bd43", "comment": "Malware payload (Mirai)", "value": "18793fa96ce7318ec42b858e6a3efe1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735083, "uuid": "277cde16-9151-41a4-81c1-3075e8307060", "comment": "Malware payload (Mirai)", "value": "c9b56a7a99339fa54af61c7089393bcc21fc3435ca05d7505744e3f592bdd45c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735083, "uuid": "6b345ba8-fb73-4752-aea2-d4f4feaf1c85", "comment": "Malware payload (Mirai)", "value": "933eb1e742262a8f5770d67e8462d0f6b7da14a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735083, "uuid": "2ba608ae-30ba-420e-b6c7-b71601c9da5a", "comment": "Malware payload (Mirai)", "value": "b126be446991c5df383d9248f635a53bd2aca6f168f882d662127c7100973268cc3f118f2cb9ad2059d24c468b14fe22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735083, "uuid": "8d302621-65ae-4843-ba8e-c9fc03d0863f", "value": "T14FF2E1A0F22DCA45F3C86373538EDCA62CC7BC24895D33396909A58680B31EC79795DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735083, "uuid": "483f8fed-dddb-4fa0-83b6-c941a5887b49", "value": "768:Zqfjt6v2PqrS02rb5rV+cWzcXe1I8KFN3ZV/Cp52Q9kZicbf8X:Zs62CuLr0/cXt8G3ZViAcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735083, "uuid": "b2bdb945-00f2-43f5-8ac2-9b279b15e1ae", "value": 36872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735083, "uuid": "1cdd5cd5-20a6-4221-b5d3-704849135bf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735083, "uuid": "f378b513-4741-4c48-b094-4ef508b4b964", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ee9cff-d017-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764745988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745988, "uuid": "899da0b2-067e-4c96-8443-a0a744c98f73", "comment": "Malware payload (AsyncRAT)", "value": "3ee62526dffe8421f9f36019ba11d929", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "sostexampp-duckdns-org", "colour": "#B90507", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745988, "uuid": "c00b2e66-40b6-44f0-ba9c-1dbf77241b60", "comment": "Malware payload (AsyncRAT)", "value": "c9ecf0c917bf8cdaa32b96b38a09b05a0bdd1c0874071712326f86d786738f3e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "sostexampp-duckdns-org", "colour": "#B90507", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745988, "uuid": "39bd7a59-ebfe-4a43-9c76-dea4588e545f", "comment": "Malware payload (AsyncRAT)", "value": "eb518b75a0bf780bbe49127eb1513dc88a4f4d7f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "sostexampp-duckdns-org", "colour": "#B90507", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745988, "uuid": "302b4b39-c3c7-4276-af69-e9560f83ab07", "comment": "Malware payload (AsyncRAT)", "value": "44eb589f8775dc82b7976e3f5befdb67a52b65d390d64a1ea846ccbf1a09099ffc7c840df38912c578b64dec59395591", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "sostexampp-duckdns-org", "colour": "#B90507", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745988, "uuid": "88d5020b-0862-4f76-992e-621ee06ee1fd", "value": "T107D431EFA250CA584F79CCE5B5FD6468E27761CB8CC6C998C6320D38E4601623D9F396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745988, "uuid": "6e941138-d0ee-4704-aaad-a6c254013659", "value": "12288:+cql/8IYaQLEoGe6z78idnO8DKrST0OFsyi25dl:+or6zoidnO8DK+T0OFsyi25b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745988, "uuid": "d016a27b-0124-4455-a01a-1f6e8d5ad2fe", "value": 612146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745988, "uuid": "0f606c41-7f2f-4c49-98ca-73e5ab58ceb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745988, "uuid": "4cb4d81b-669a-43fc-8363-db724f61c1ec", "value": "c9ecf0c917bf8cdaa32b96b38a09b05a0bdd1c0874071712326f86d786738f3e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a39611b-d02e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764755794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755794, "uuid": "20b490da-5ff6-4f10-878c-541826e813fc", "comment": "Malware payload", "value": "3b61591ee858054b3344e21b0bfd79a9", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755794, "uuid": "7f777b40-33a1-4601-a98b-6ab8560ccd55", "comment": "Malware payload", "value": "ca87542a15df9098f1e6be66c44b05546a99037c90d58d300a1686f44cdcf232", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755794, "uuid": "1adbc05b-d6d9-4444-bf9e-f4b634a84a86", "comment": "Malware payload", "value": "9f87b3c57fbeae1e515f9e5a384a1c615b6f58a7", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764755794, "uuid": "1cbb88c5-9bde-45e9-939a-19745115faa2", "comment": "Malware payload", "value": "aa24ed0a5e64788fc2157eca2a5cc151ba00390fa413a845d4fd295e666823fcdd3c3a71cd4bc384e1ce379d0f5bd01a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755794, "uuid": "6d6aa3bb-fbb7-46b1-bd27-a2d913a42f21", "value": "T197E07DCBDA1E4007F0408A35FC010D79EA48C486C978F31B5922A9860F270971E62842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755794, "uuid": "da18a811-0b82-488a-a409-e509572f2e5e", "value": "6:5jG22rDaW2e2kFdtsbmrmGldBfMjX/NbJdEX8vG2/aft+lc:5jpMRFvnJBOVfEX8xStac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764755794, "uuid": "a2264272-ea78-4461-a2a4-a64f401f5dc4", "value": 334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764755794, "uuid": "eb1d425d-5f05-4837-9dfd-e9f28014266d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764755794, "uuid": "a08d030a-bd4d-4716-8b42-e6ebe326f0d2", "value": "INV26638463444.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc12e9e0-d018-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746537, "uuid": "d694fb7c-fba4-40f3-8d71-c95f6b361b62", "comment": "Malware payload (RemcosRAT)", "value": "7814ffae51a34295fd49c05c81d5a483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "practicalplayercontact-duckdns-org", "colour": "#806685", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746537, "uuid": "7d69591f-8f06-426f-9f7e-361136e11a11", "comment": "Malware payload (RemcosRAT)", "value": "ca991d967932df2b405dbe61b635f0f1e9363c0964ef8ed6ddf6692a47e8d213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "practicalplayercontact-duckdns-org", "colour": "#806685", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746537, "uuid": "926bcf12-6780-4eb7-9f12-0ec097351465", "comment": "Malware payload (RemcosRAT)", "value": "e0c2b188f9f47a75e5947a6e30d2304f4005485c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "practicalplayercontact-duckdns-org", "colour": "#806685", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746537, "uuid": "c99e89eb-1106-4d02-8a58-d0fbe8012b85", "comment": "Malware payload (RemcosRAT)", "value": "bcd27f211c32d2a574d93bf58665652765022a71da1582744c75d7353895302200140831ec81a75fc44f28f37b9b75ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "practicalplayercontact-duckdns-org", "colour": "#806685", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746537, "uuid": "afd2a1d9-2921-4e94-8234-9ff662ceefe7", "value": "T1B7B4AE01B6C2C0B2D57614300425E775CEBDBD281C359A7B97EA1F6BFE30150EA29BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746537, "uuid": "743f624a-64f3-41c9-8713-526532ba6bf3", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746537, "uuid": "4810be86-770a-4f12-a340-bf3fa42b484e", "value": "6144:yIg2mpPQ+w9X009Ge6WJ8buvAxJ5u0IyfUbbXQCl9jUkrFopsAORZJ2XD2NcLQSq:+xUyuGk8uvYvu0IhDQCbWsPZJwmPFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746537, "uuid": "6c1b5f74-d41e-4a0b-9a7d-f96cedc18c3d", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746537, "uuid": "e36486da-e04d-4c3f-aec7-a38619732832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746537, "uuid": "92312905-6166-4da6-8219-43b4c3d00692", "value": "ca991d967932df2b405dbe61b635f0f1e9363c0964ef8ed6ddf6692a47e8d213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2635d2fc-cfde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764721347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721347, "uuid": "47140053-8869-4ade-bfdd-8fd9a6c05bd3", "comment": "Malware payload (Mirai)", "value": "a04024aaa1f3065238f4a93ee003c811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721347, "uuid": "2656641e-c491-432c-975a-d1a09a29ff1a", "comment": "Malware payload (Mirai)", "value": "cbeb6003217797f5f1ac9c58d57adf7696fbda8e6b2f156841eb63487b3c86d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721347, "uuid": "94e4e11e-ba45-475b-82bb-7ac01e2945af", "comment": "Malware payload (Mirai)", "value": "6cefb8928a9967d5b3ec28b2cefbb4b91cfa38ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764721347, "uuid": "d16189dc-81f2-455b-ab9c-c97776547630", "comment": "Malware payload (Mirai)", "value": "6e7e1e25475f911178d6578ee1503e64edaf5b1b2b1d36736f88482e891ce447973d7c9b30e11049ab69fc9f0551f959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721347, "uuid": "2312a1e5-13ea-4535-81c3-af9b952f2885", "value": "T13CE34B02731C0947D2632EB43A3F67E093EFEA8121F4F644651FAB4A9271E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721347, "uuid": "4a34db94-4b6c-49c9-9b4e-b16852cdb9b5", "value": "1536:cHjJFn9YkHXFkNVGDS3xiHkhGG+Xdiy7/WIPPFiEAbvAazVm8P2mqqrQr0Y4JQv:SLkNbxCXx5XPEERaZPnQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764721347, "uuid": "6ab69814-dea4-456f-b993-786b9a4c8283", "value": 151700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764721347, "uuid": "544cd9ec-d156-4b39-80e3-633c236771e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764721347, "uuid": "4efdbc75-f345-4892-bed9-e4ea8a25372e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25ef897-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793792, "uuid": "c60faf54-df4e-4761-aa33-c7c82e05088e", "comment": "Malware payload (Mirai)", "value": "8268513b7abc74dde5c40f8b2a8e4567", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793792, "uuid": "9dfa0daf-adf2-45c3-8aef-0b48ced8a4b1", "comment": "Malware payload (Mirai)", "value": "cc1efbca0da739b7784d833e56a22063ec4719cd095b16e3e10f77efd4277e24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793792, "uuid": "dd57cfcb-04e8-4c4f-aea4-b5c229b31f91", "comment": "Malware payload (Mirai)", "value": "b630e56c008c452cd01785ed22bb3a830cf86a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793792, "uuid": "9de629eb-717a-4c97-a8b0-7199d541ba45", "comment": "Malware payload (Mirai)", "value": "53d9478da55dd012d4ef3df0f331b1c1bb15741be4a4530c88794c9ba2bfab1a41326a7de7f42e895ec1daab5d32650c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793792, "uuid": "03096ffc-3749-4d62-b893-a379871489e8", "value": "T131936C22B9791A3BC5E0647B11F35325F1F6538A10B88A1E7D710E8EBF219D03A477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793792, "uuid": "aaa2fc07-31a4-4f62-9beb-bf8bbbc12307", "value": "1536:73qCraLjxS3YOdVvF6a79jMlnItehZYm5dm4DeUtWNQ:DT245xOIAZYOMNNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793792, "uuid": "5ebdb7a2-b18f-4d81-a363-f0c4ddb0f7c8", "value": 96736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793792, "uuid": "d925d048-5338-490e-9aa8-e247053e9e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793792, "uuid": "66415758-92eb-4e97-963b-f561c9b691d0", "value": "zerobotv9.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb36243f-d00b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764740952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740952, "uuid": "038957c6-f858-44c1-ac52-3a55d8541cb3", "comment": "Malware payload (Mirai)", "value": "7f188fcf0ce1c7e813900b665659fd0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740952, "uuid": "027a451a-bda3-4982-a03a-4afe9a6b7598", "comment": "Malware payload (Mirai)", "value": "cc2dc4ba7685800123f0e6cf69f77d7e49c722b09b61d1552e567dfb37e5cb17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740952, "uuid": "372d7b6b-98d8-43c5-9360-3edcab8bc05e", "comment": "Malware payload (Mirai)", "value": "4557bf1c1759d697f226620c3b46c8f2f36ac974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740952, "uuid": "872c8f28-ebbc-42b5-87df-4043541cbaf3", "comment": "Malware payload (Mirai)", "value": "dd6720fcd7542678360ccd9b44f3ba33b5bc0a5878596e8873583be6d18753c0afef4cb8318ea4bb27f7d7aef302662d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740952, "uuid": "b1606c63-8c4e-42ad-927d-a743c60b1bde", "value": "T1307302D529E819F5ECD642713814A3BAFE52C88872B5712427389FC6AECF8C793542D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740952, "uuid": "0fe1c6b1-fbe2-4bc4-b192-26bdf67b1127", "value": "1536:Wz0w6/2FHQYC1AtvzKHEP0owd7jcFX8gMvzWh2T08ks:Wz0wiQ8ARzf0rjmsggqh2Y8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764740952, "uuid": "414e7a78-c292-441a-8010-b8b7be5eed98", "value": 80452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764740952, "uuid": "d38b1956-bab5-40c8-864c-f3651a118f71", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740952, "uuid": "b77640bb-53a4-4890-ad87-892546a5d420", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a0ba23-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764770328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770328, "uuid": "bede1b8c-df99-4bfc-b7ab-bfdbc81d079c", "comment": "Malware payload (RemcosRAT)", "value": "0cee71a26235fbb2bd141a1e93e1de92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770328, "uuid": "6a0a5b47-22ed-487b-af94-73572a476c09", "comment": "Malware payload (RemcosRAT)", "value": "cc7d970b366fac85dffbfef76441a241827cad22ca0797f8c19d5b1bad4b8b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770328, "uuid": "97d69b92-05bf-4e1c-8df0-bff6ee11ed75", "comment": "Malware payload (RemcosRAT)", "value": "f2affd7566aa1fc856acb1545770c083f1ad3ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770328, "uuid": "b0a38c1b-ea32-4d74-bb34-a95d3a6c245c", "comment": "Malware payload (RemcosRAT)", "value": "1b6135ffae6fbe12d0166a75764e7eb3a9891e1814957a64ce04ed3a21ab7d035f003c0cd8d4b10e2c065531fa93850a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770328, "uuid": "7a04918a-d5b0-403d-b303-b0b738f75464", "value": "T1C765E166A1F18836D113DBF48C1592CA542D7FB03EB168163ADC3F988FB9A752D160B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770328, "uuid": "d5af9f7b-0c55-4a58-a3df-c4ac8a759356", "value": "9c4555569e4cd0e05606fabc204201b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770328, "uuid": "5982d992-3cb7-41fb-aebb-9bcdf70d847a", "value": "24576:GEkPEEYUY5OM1jHmB7FqyJQuiMuA6H6VtV3oX/J/fxPS:GZMJEPqyJkATVtNYhVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770328, "uuid": "bd439ed3-a00c-4e00-b2b9-beb8657cd255", "value": 1481728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770328, "uuid": "bc57d374-e9ad-446f-bb7d-23f568a6ed18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770328, "uuid": "ad275331-edaa-48f5-a54c-3a015fa18731", "value": "20250312_140005_POXFER_JP_49790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158a9fba-d022-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764750525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750525, "uuid": "4db662d9-0a05-4c58-9f47-e4ca40e85191", "comment": "Malware payload (Formbook)", "value": "03de069564834a8a4251d030ab4da819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750525, "uuid": "c5af04e0-38cc-47f5-8bc2-a199dbe2e5ba", "comment": "Malware payload (Formbook)", "value": "cd35cc5ea80b1095440dc72d654918d474907fae82987851f5eb0915fa21184d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750525, "uuid": "36e182ba-ab90-4fdb-9e80-61e6ff8276cf", "comment": "Malware payload (Formbook)", "value": "08f8addb9265af00009465df59365f67c8d8658d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750525, "uuid": "416873a6-6c22-4dbe-b9e6-f8e6b89f5601", "comment": "Malware payload (Formbook)", "value": "94418d9245ec0da8d42ca05bcc3c4c551973b43b0ae4870c8f3be534086347ec24cb83d39998b64f70dded159c279b95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750525, "uuid": "e068c9f8-745e-415c-a757-0f8b24cc6b61", "value": "T167E4129C2645C913CD4923B50E72F6B427BC1D9EE901D296AFC93EEB7972F140E08293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750525, "uuid": "df0fa466-6c90-4b07-bfe7-6967f4b26901", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750525, "uuid": "d2b17994-88a8-4493-b48b-e151187a1ccf", "value": "12288:0kgkq/KTn2as2HzApwt5Ei4nh8C9PNOLggRX5LQ1zw2y8m0+g:0kBn2Ru06LuhLPNbgRX5k1m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750525, "uuid": "d4cb7c38-7ee8-4b95-80c4-efb7e0c4065f", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750525, "uuid": "e54969a9-f239-4e99-90a9-cbf5db7c5187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750525, "uuid": "8b1ee934-0c14-46ed-b19a-f84105419224", "value": "SecuriteInfo.com.Variant.Application.FCA.2785.4470.29564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e287ccb5-d001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736696, "uuid": "22bb33dd-6eaa-4a99-8539-a698e00bc189", "comment": "Malware payload (Mirai)", "value": "4363c405c68333dabc4912c1d77e633a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736696, "uuid": "12a5b44d-3eb3-414f-b34d-202b3a388517", "comment": "Malware payload (Mirai)", "value": "cd82c602f8aab894ddc1c2a3c55976bbd4dcd8f69979abadaf62b48858a342da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736696, "uuid": "4729fbe1-d826-4070-beaf-98c923a337f0", "comment": "Malware payload (Mirai)", "value": "8e61fa472a069fc471aad763b66810e3d32aa9dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736696, "uuid": "e18ade1d-c95c-4b48-927b-a9bf6c52b50d", "comment": "Malware payload (Mirai)", "value": "ba85ea7847ad3072aa0d361269300dcbcb46a25129b6dd653276b7e7678f22f1bfb8ba5c1ec4b957250012bc1ae99fd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736696, "uuid": "f2ed1146-6795-4ee7-b0a0-7a57b24dbe8f", "value": "T14A9312DCEF45F9DE5DBC0DFE70E6215085B0A44793CE0A1DEB30395882F5D2A08E16A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736696, "uuid": "fc92e451-244a-45b0-9cdb-63c83b6fc167", "value": "1536:uzMUR5/MmxfgGFasMCMJ7i4QSFLBWOnEMeFwD5wPzNdkOjgeI2utJ:uzpR5EKgGFGi5KgOEMeFwDWN+ggeIzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736696, "uuid": "06c2ae0d-75a2-4d4f-b78f-bc39e4c6336b", "value": 92272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736696, "uuid": "c57f917a-7ead-4faa-b78b-fed9ff157299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736696, "uuid": "fc86d94e-5583-4163-b5bc-3f652ea3a98d", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2118366-d022-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764750788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750788, "uuid": "116efe62-e483-426d-a93e-38c5aec11666", "comment": "Malware payload (Formbook)", "value": "58a6d9e8541a979641e45ed6a8ce7450", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750788, "uuid": "ce6228c2-dc2f-4dd2-8624-666ba1903ca1", "comment": "Malware payload (Formbook)", "value": "cdc7c2d40b1e404f7ad949349b0763ee8ea2038afd21ecd6c5285e3e73912297", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750788, "uuid": "b8c7bb3c-4962-4808-92d3-6334e82b3d7c", "comment": "Malware payload (Formbook)", "value": "6417e3a27cbda572c02fa2da68ceb1e27e1a2ff2", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750788, "uuid": "a4e026ee-f97e-4bcd-bfd5-d67a8ec5b100", "comment": "Malware payload (Formbook)", "value": "7cd3d52792ebb1f27e57723f476ca9e4c7f14e4ad30f3ed943aa6850db0c1a432b3de1bcfae1e8524a6b505b308ee10e", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750788, "uuid": "6d289cc1-cabe-4120-a9f9-71b118dd17d8", "value": "T11115227B07EA787EC84D46FB9363B67238292D48D67C7A15884753CE6A0004F17899FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750788, "uuid": "91c842ed-6c1f-4d32-8866-46b5b806d945", "value": "24576:o2gdrFt1+RHl5DujKD4B6UTuEY1qrxDv25uT+FROW:gxtgx8KDk6UTud1qrxDO5DFRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750788, "uuid": "0f14dba4-4abe-4fad-84a7-9631aa73cd49", "value": 925482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750788, "uuid": "a6175416-d115-4886-8454-059eb5c002e0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750788, "uuid": "e54cd306-d4e6-4285-bb4e-68590cc8596f", "value": "CI & PL.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23af075-d03c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764762062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762062, "uuid": "2f6a0859-e343-43b8-a018-3b7bd599ca01", "comment": "Malware payload", "value": "26b91326eefb783e634491dc0f5321ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "users-freenet-am", "colour": "#B551EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762062, "uuid": "fd7f1fd2-fb5f-44e1-9945-0c91747fb4e6", "comment": "Malware payload", "value": "ce29f64530cd8f84d588aaefe6e6ccdb1ecf1f6b1f1554b367e455127c342bac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "users-freenet-am", "colour": "#B551EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762062, "uuid": "75da0921-aa90-47ae-86f2-366dcc54cc61", "comment": "Malware payload", "value": "a5411d239f39bad53cf1b8d1404f05669c327aa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "users-freenet-am", "colour": "#B551EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762062, "uuid": "dba70726-abbb-46ce-9628-1b6b6e4c0efc", "comment": "Malware payload", "value": "27086534d7cf075df5b6b2a03de69e6dff30b6466048f21b55385511024c6e5e51fe19f21ca5dc245adcd472893cb0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "users-freenet-am", "colour": "#B551EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762062, "uuid": "e8b1a642-2b48-4435-8a56-547e1e53a17f", "value": "T1D543D096327ADEF2D08A0138C5D3C7A87369E544A7B917CF42B0FE4FDCAD21585EA094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762062, "uuid": "9f4312bd-afe7-45bc-99fa-f3b621fb7d48", "value": "8b21ff8a0d0059e9d67b568f049de051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762062, "uuid": "5fa28fb4-850d-454b-9db6-73969a9a10e7", "value": "1536:xCaL72e/TP8XGwy/8j6mQgFNRlp/Umlzqt6bV5eRP1y:xVL7XPxwy/i6LuNRlp8mlzqGDeNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764762062, "uuid": "52b60959-e1f5-4104-b193-f4e16b41d31b", "value": 57993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764762062, "uuid": "43b8d2c1-1291-458b-b1e7-2f6fc128d975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762062, "uuid": "5ec43f2d-3fb6-4c91-ace5-4412fea197ad", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494be793-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767362, "uuid": "419e98f9-280c-4924-9db9-7f6be56b6503", "comment": "Malware payload (Mirai)", "value": "c50ec6683336f967061e37a05f03f9bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767362, "uuid": "b09d6b9b-9a95-43fb-af2a-1d0b46972467", "comment": "Malware payload (Mirai)", "value": "ceef695929990d6e1d960beeaaeee26dd541291f033551b4805a55e6f076a3c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767362, "uuid": "ad798021-ef6c-465b-944e-42fb084f113f", "comment": "Malware payload (Mirai)", "value": "45411afe774b95136045432a424403ea132d80b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767362, "uuid": "7cf90a7e-5f20-4336-b9ce-dbf3e4f47e14", "comment": "Malware payload (Mirai)", "value": "80e17a5922b9e94f93569b07b0c921a8ab3d4c80de44c7746334e277c46401dd6193ebac8fb0f614bded10218c6be89e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767362, "uuid": "0145d3d8-258e-404a-9ffd-81e6e25648dc", "value": "T155E2F14A88D8AE1ECA6553BC556E7780FA15A5A42F5F53016ED5CCC2A8033F5F131933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767362, "uuid": "4b691b39-d993-4a1e-a0f0-436f2ce79440", "value": "768:WBbVkTrCrlX46JCSVO0smsL0AjDTK1xtltOI:Kp4ADsLjPK1xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767362, "uuid": "6f1d3669-7000-4b00-b60b-55da0c4579fe", "value": 32276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767362, "uuid": "68f38ace-0e58-4db7-9146-b7a3f8c06361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767362, "uuid": "4746cf1d-fc01-4120-8113-491dc4d8c6aa", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f603329d-cfec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764727709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727709, "uuid": "d47bfb4c-d0fe-45f0-9d07-e078ac1a849f", "comment": "Malware payload (Mirai)", "value": "3dd856ed7b3887c48a540ad5d7c27318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727709, "uuid": "f775e407-6bc3-4f3c-b8e4-a13a40ed8cdf", "comment": "Malware payload (Mirai)", "value": "cf7b5b43ccd01f641cd0b6e31ffec6107ee7024de6cc06c6509e98b287af9cf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727709, "uuid": "a168b99f-0f79-49b4-87b2-d78e03671db8", "comment": "Malware payload (Mirai)", "value": "89c8f9b407074eb3c67fe20bc5ead984457b3a0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727709, "uuid": "07a0660f-a692-470c-a476-8b5cb68c21a0", "comment": "Malware payload (Mirai)", "value": "253bb8f69490a0f176a715afd6e8fdbd302eb95b0e0d4fefa0009be309689e1fb8286d1a80ad865a10846a5b67bdf796", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727709, "uuid": "32158a53-0d80-4b6b-862a-7939a4fd79b8", "value": "T15B93188AFDC29A02D9D115BBBE2E515A334767B8E3EA3213DD14172033DAA5F0F36506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727709, "uuid": "977b67c7-3300-45c5-8eb6-647d98e938d0", "value": "1536:X7nptbirnRSmFcGIOFMULG3coDh93/IuoWBOMm75ZllXBiynSqbjF7Et:arRSmFPIoMULG3co1lXoWBOMmDFnpPFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727709, "uuid": "c6b5f086-b8ef-4aee-bb93-78c0c47f8325", "value": 96500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727709, "uuid": "212fa42b-44a6-4506-9a1c-8df8fae85949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727709, "uuid": "6372a99b-fad2-47f4-aae8-5e05976fe608", "value": "arm4t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae03eb4e-d03d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764762377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762377, "uuid": "9a7ce0e0-971a-4c02-b54a-19b7f83390e1", "comment": "Malware payload", "value": "4f5536dd627a869382a6bdff90b61009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762377, "uuid": "f345662b-5d04-4d49-a1df-3e88ab711c9c", "comment": "Malware payload", "value": "cfb35df8750c385d5b25613ceb13bc6245da1fbf16534417b32015cd875eea88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762377, "uuid": "cce37409-3753-4e8b-84e1-34c0851c0382", "comment": "Malware payload", "value": "8a84a2fdf72fc6ee90019e0a29de1f2663103e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764762377, "uuid": "e6e5f790-7dc5-4cd2-9db6-c35112cb5a70", "comment": "Malware payload", "value": "8e0e700401aee9eecf76e36be654c4ec133d25a74caf9d13f6cd0ae8ebf8674e3339c6204b5fe2c5a9eb76d7de4f0c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762377, "uuid": "233220c1-22b9-42b5-881e-3d5cb209ec69", "value": "T1F9B5335AC686007FFA48A534249FE87E913737813974216AE36C4D3BCCF7885CC3A969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762377, "uuid": "688114c4-b421-4a53-bb01-231f680a6c68", "value": "1b6d42ae1f974936c6f60c47b79f7fcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762377, "uuid": "c8cb3ed9-005e-4c63-9e4d-769677d74231", "value": "49152:/Wa1yT7V4AuEiwjrLmq+O1GjvITrN/Rji+nBUn5dSsFp5g7ms5vmtqDuhUxEc+L:b1yTGmiwj93t7jiOBUn5dSW58jYtAVEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764762377, "uuid": "9efa5086-9c30-4b74-b1b1-70c3e9cd2e46", "value": 2445063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764762377, "uuid": "b520495a-252c-4504-896c-1414332fc5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764762377, "uuid": "caaab7d3-562e-4df9-a4e9-a0ce21749bc3", "value": "12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d609ee3-d022-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764750726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750726, "uuid": "eff55bd6-cb97-48b9-a0a4-d652701a3403", "comment": "Malware payload (a310Logger)", "value": "07978a135ab5873dad35f38a3eaea2d3", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750726, "uuid": "da2fa5d6-fbfc-40a7-914b-aad7314e3ac3", "comment": "Malware payload (a310Logger)", "value": "cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750726, "uuid": "8d757d4c-02ca-4412-adf6-3c76b413ad2f", "comment": "Malware payload (a310Logger)", "value": "1de10d7e4647cd21b56cc70c0da34a113c4fe95c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750726, "uuid": "b1d29c9a-4828-44aa-bf4b-2d5001520d25", "comment": "Malware payload (a310Logger)", "value": "5ab6a670b6b84aabb41df49bf73d1a38799fa1db408b9a64cf22323bc7d0a4d213bfab226dfff74400060a5f08ced027", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750726, "uuid": "62e9827b-d681-4b0a-8fef-6f8e75b55e5d", "value": "T13955CF027391C062FFAB91334F5AF6115BBD79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750726, "uuid": "6398f844-3515-43f1-952e-ee30a0dfa9cf", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750726, "uuid": "772eca22-1cf7-4d6b-8134-1897a5baac72", "value": "24576:f5EmXFtKaL4/oFe5T9yyXYfP1ijXdaz+sGQ2wjJ4JIst+wtIc1lxw:fPVt/LZeJbInQRaz+5WjSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750726, "uuid": "5b03cb53-994f-42ec-b5f6-9a652f828943", "value": 1362944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750726, "uuid": "4968b4fe-60ad-444b-86a2-590da0794596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750726, "uuid": "869b455e-b7fb-48d4-b8fa-7491787db2ae", "value": "proforma Invoice Sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceddafe3-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793786, "uuid": "2d517702-a92e-4d28-8d3c-565c2d1c15da", "comment": "Malware payload (Mirai)", "value": "0dc09dad9cd3561e294ab3a91c6b5e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793786, "uuid": "536919bd-dca3-4550-9931-6974d149c95f", "comment": "Malware payload (Mirai)", "value": "d024039824db6fe535ddd51bc81099c946871e4e280c48ed6e90dada79ccfcc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793786, "uuid": "9daa7cb1-9046-4eb9-b6b6-8b32f69d025a", "comment": "Malware payload (Mirai)", "value": "1b4005f4361234c07c509ab63ffa7342d9a7b18f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793786, "uuid": "f7800ed8-9c1d-4a23-911f-f4bb80c9f4fe", "comment": "Malware payload (Mirai)", "value": "d8ca5aefdbb49dff099b961aacb8db126fa6a1591686d1ba53ddab4ec99e94d2bc30930fea4776bbcb5ee3e2d498f23c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793786, "uuid": "a8640388-59a8-483b-88e2-49ba2e81879d", "value": "T1DCA328D6B401DC7DF80FDAB64463590EBA31A35116831F27639BFEA3AC321E45926F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793786, "uuid": "101aab9e-5094-4b01-88a5-3358c4ca8102", "value": "3072:DiRPdlJIMkbuhlzinVh/A0o38RZqdhZWvgFE+:KdlQu64b8PqovgFE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793786, "uuid": "cd0cde6a-635e-42f6-91d9-b1696fdfda39", "value": 101432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793786, "uuid": "4def0cdb-a6f2-4982-ad5a-bb2e5d878948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793786, "uuid": "727b706c-f7df-4c0a-9f8f-692e5b072422", "value": "zerobotv9.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4ace90-cfff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735828, "uuid": "baf5d9f5-7ece-47b9-88fd-226693c01ea1", "comment": "Malware payload (Mirai)", "value": "4f82dc6e70712052a28051dd1a5ba843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735828, "uuid": "05336457-4350-4799-8330-c21d10076763", "comment": "Malware payload (Mirai)", "value": "d0374247ee4d23fa97e3b44b7ba978a5e88e441d715b945a1a376929e17a707e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735828, "uuid": "f2f2c560-e6c0-4bf7-97bc-227d1ea2e28d", "comment": "Malware payload (Mirai)", "value": "de4dd6fb71533b85eed6abf6bf0dc7bff68d046d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735828, "uuid": "a1250600-8d19-4178-8b49-d64e519ec70c", "comment": "Malware payload (Mirai)", "value": "5b557e79dd12175a8864d987a553fa71c16d3af77fb1977d66632fc713980c3c7adf2e61964cfef55ace58f05cfa3956", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735828, "uuid": "a2ecc775-9c76-4947-a2b5-919c7f20ae54", "value": "T11EF2F1F1C46CE716E9A4503F42BBBE1F0204BE052ACD3E4A2E9E9D4D14E2119DA7CC8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735828, "uuid": "7b4e42e3-312d-49aa-a30d-19a41c7312d2", "value": "768:wnEgI6iQmjm0/AizOZzSbW/Jn36u6ldQBmW1UOxMJc0O/2E:PgNi/mUzOZzkWBn36u+WL0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735828, "uuid": "898601d2-665f-48eb-a465-9c9c9f1728d2", "value": 36320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735828, "uuid": "60b9d9da-435a-4a03-a9ac-b92362841395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735828, "uuid": "2824f85c-2370-48d0-83d7-f80df2a3a6a3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904e1d8a-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767911, "uuid": "0a829196-7024-4c94-9b99-5692d9851659", "comment": "Malware payload (Mirai)", "value": "c850453aeeb31d4dea913932384f4fe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767911, "uuid": "7169abcd-5a70-4cc1-960b-e785dfd9056b", "comment": "Malware payload (Mirai)", "value": "d1a8a667041656a04c314993e309a8516e673b14a9b0ce3c5398bed9e4d13ca2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767911, "uuid": "460043d5-1570-4a19-bea6-99d02c15f881", "comment": "Malware payload (Mirai)", "value": "10b6ec77e09d793525365b16026c669061ade86c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767911, "uuid": "a5557393-568f-40ba-b778-fb4b98339ac0", "comment": "Malware payload (Mirai)", "value": "a5ea83f8f03bbe03563aafe176a1422f2adf95199d71cb92a6beed073add3fa2c36b6a8f1e34be260a5c24ada1a67b5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767911, "uuid": "ceefe925-aa22-4de2-a573-dc751452f7d4", "value": "T193D33B86B8D18F11C6D122BBFA1E019E3326576CE2EFB2039D245F3427CA56B0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767911, "uuid": "d6fb6f5d-3138-49e5-987c-262814722365", "value": "3072:fOv7509Xx7q5TYXAmGLQv2oafXlF1amPVXai13B6FI:fi509XxhGLEsX1aQVXwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767911, "uuid": "a1faf1f1-8bdb-43fd-97f3-5000e8a593cb", "value": 136792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767911, "uuid": "50f5d856-64b9-4b04-bfdb-f273db77ae4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767911, "uuid": "bdaae201-d0e4-4886-b28d-bbe0fae84993", "value": "SecuriteInfo.com.Linux.Siggen.9999.2326.21323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2812519f-d09f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764804243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804243, "uuid": "569c2f7a-02f7-479a-9363-3b83a618f943", "comment": "Malware payload (Mirai)", "value": "5223772077a7d4add788c8f0f46a04da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804243, "uuid": "39286812-b9bb-4055-93fa-a7d9d224fe10", "comment": "Malware payload (Mirai)", "value": "d240f7082ceec86c96eb53f36e1f4d8c21422f76cff5b77647fe6680676a8b77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804243, "uuid": "dfd3613f-9635-4ee4-bd49-2e5f28ff81f5", "comment": "Malware payload (Mirai)", "value": "524753b1c5bd8ad2eabc48be4c51c713577967fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764804243, "uuid": "5059b9f5-ec18-41f4-88df-007b655e0d51", "comment": "Malware payload (Mirai)", "value": "cb2c32221461a2a4901df74bef50b7c3e84a66906e2b2fd0bc31fb08261f68b469fcbb96232c42906520607a535174c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804243, "uuid": "4312dd74-9529-4f26-bd7e-7ee552b06200", "value": "T1EA23F168F5571533C3701B37BD89C60703991F6A633EB6B021F829B8BA05E1F1B69286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804243, "uuid": "ba059b08-96ef-4bef-a6eb-98c83a0373ec", "value": "768:tEjYJiXLP/VxiGW9HHiaEvN1rmLptzICwsHZgkfs3UozhQ/:t38XLP/Hj8iLN1r8ICwsHlSzi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764804243, "uuid": "79f92041-57e4-4b83-b517-7b549c18c4e4", "value": 45988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764804243, "uuid": "dafdb161-7912-4389-8fb9-b0501aa19898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764804243, "uuid": "af483ca7-6446-4dee-9acf-cf6c4415e56f", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6a5afb-d07a-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1764788361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788361, "uuid": "209f567c-6297-4f80-b469-2a1b1b31c25b", "comment": "Malware payload (Efimer)", "value": "1d5d8b62ff57a19b7a2ffaa3c703d9d9", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788361, "uuid": "2d09c14b-7b7c-44db-b64c-8b88c7d37329", "comment": "Malware payload (Efimer)", "value": "d240f9c3f1abac605ada8cb3b811af7d92dc7017b503a5ef0202fdbf9425d100", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788361, "uuid": "bc87714e-1999-43fb-afe5-479a5b1d1e9a", "comment": "Malware payload (Efimer)", "value": "3715ca1aba9732fbe9803039f293c3407e9148d5", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788361, "uuid": "58e75690-e22d-49db-b8f8-7556b1c5128a", "comment": "Malware payload (Efimer)", "value": "a523d810951705d2d0843fa967269b20848d6face7106bdc1eec142417f554bd1c33601d47e9d710d8e82776317f2fe0", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788361, "uuid": "ffa9e812-011d-4599-bd8d-ba0139e75f82", "value": "T156D633586AD051FEE9F3413CDFF066A6E87478664336C79B83B846642E236E00939B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788361, "uuid": "583ee9ae-ce4c-42c6-a150-89d9ab58d3ee", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788361, "uuid": "864a92d1-1624-4c48-a0d7-021dd9bc5cc5", "value": "393216:e0mnL+IPiyYQLJH6XMCHWUjlcuI3/PjuUwQ:e9xKyYQLl6XMb8SH/rAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788361, "uuid": "d0bd6fdc-7764-4b4d-876b-177616c59596", "value": 12629922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788361, "uuid": "70c96854-9ad8-4e3b-bc92-1c0e27544921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788361, "uuid": "fd60d852-dded-494a-b1e1-c250aa9a2ca4", "value": "\ud835\udc1a\ud835\udc53\ud835\udc61\ud835\udc1e\ud835\udc2b_\ud835\udc52ffec\ud835\udc61s_v\ud835\udfcf9\ud835\udfd84_\ud835\udc54\ud835\udc32\ud835\udc2d_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9ed20a-d017-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764746185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746185, "uuid": "c3c6a296-90d3-495b-b313-4d879a36565a", "comment": "Malware payload (Socks5Systemz)", "value": "0848c0a3d45bed934d7a7e1a010c8062", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746185, "uuid": "8a3f9b04-9ade-499d-ad3e-d1100a6509f3", "comment": "Malware payload (Socks5Systemz)", "value": "d2eeb890bd32252a785a1a2099fcb87ad03f3561828eb1ae6d040dbc4ed4c3ff", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746185, "uuid": "e76cf766-be6f-4617-9dec-9a26bceb71e6", "comment": "Malware payload (Socks5Systemz)", "value": "2576b7d9e914960dae2f21d2f5a83004beb092ef", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746185, "uuid": "6b540fcd-7f59-4f0d-bc12-47dd9180f28e", "comment": "Malware payload (Socks5Systemz)", "value": "6753a0c74fb04686fe0e02f043a56f30c6d7e65fc31c16a56184311adcb431ca678a97f23eb6cdaead3a085715cdbd64", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746185, "uuid": "4cc8c537-5f4e-43c6-8faa-2d2e5663b1ea", "value": "T14F0633E6C686C5F9D03216329A581A7BCC7FEA1A3F30140B375E54AD1F339DA89487D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746185, "uuid": "13987bb6-a81c-4a3c-a8e8-5fa48cbf56ff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746185, "uuid": "4f166650-0973-4df8-87eb-62fd84d25395", "value": "98304:MfGaRBddRv6+qialpRdzlhFcfiPZ2qdAVRc3A:ePddRv6/ialDdzlAfyAVR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746185, "uuid": "892c9ee1-e2b5-4358-90d7-1bd513def0c5", "value": 3753293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746185, "uuid": "60ada1e3-7324-47d3-9a70-27a761cea61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746185, "uuid": "53beeabe-4d95-468c-8c1d-babdf7633cba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62e7e70-d052-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1764771491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771491, "uuid": "8fedf52b-8835-453c-8528-f703ecf16c7a", "comment": "Malware payload (GenesisStealer)", "value": "d345234147b91f3f0042d3750055cb28", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771491, "uuid": "81316538-e3b7-4cb5-bc25-5ab6de16dc5a", "comment": "Malware payload (GenesisStealer)", "value": "d2fe0cdeaa9e6da3ef89df6fe632458b7e841bd416efb02ab1899900eec5ca45", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771491, "uuid": "cd70050b-f052-42f6-b9b2-b19f93fc0116", "comment": "Malware payload (GenesisStealer)", "value": "f4521054d1feddc647ba93469405cad4faadcfa3", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764771491, "uuid": "3a11dbb4-24fd-4c78-aaab-e6c5dd710d9d", "comment": "Malware payload (GenesisStealer)", "value": "e9c539c7dee907fdf42b4e26b52ac0b670b57dcc9e9c45667a181fe680d1732d8f4cba30efe76cce9336b4379fbd509a", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771491, "uuid": "230fb0dd-e2ed-40fc-b516-c8eb24d99ba2", "value": "T14DB4D0DFC31A2EBC9581DE6C818E31D058AB6E0D793E19B12A70D541A143B6B7017EFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771491, "uuid": "76c396e4-c6f0-4de2-8866-6820fa079f7f", "value": "12288:OiNxMM8hg2jANABBcQaHCfs4GpKCTLuX1C/EZa:OIqThg26ABOji+duCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764771491, "uuid": "a7fffa1b-4553-4b09-8110-3d0bf0f2dffd", "value": 525271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764771491, "uuid": "46de718f-df01-4856-a0f6-ffe129a078d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764771491, "uuid": "da5424e4-44ea-4e8c-87d6-12489ab4e740", "value": "e823e8e18e4e3854.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d99826-d07d-11f0-a129-42010a9c0007", "comment": "Malware payload (AURAStealer)", "timestamp": 1764789711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789711, "uuid": "c8540f54-c8e7-4655-acc4-e161127c2cf3", "comment": "Malware payload (AURAStealer)", "value": "64ab561ade94ea73997be46d88c931b5", "object_relation": "md5", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789711, "uuid": "cd6b31f6-336e-4a1b-8ca8-0d5e5f62265e", "comment": "Malware payload (AURAStealer)", "value": "d3c1ec6d77e2ae2106a7c2cb8ea1230420067c58696b893ff0621c61a84e50cf", "object_relation": "sha256", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789711, "uuid": "207b3426-c1f5-4c8b-a9c5-7381c17d20c6", "comment": "Malware payload (AURAStealer)", "value": "088f37690acb2e83f2aec1f365b85497e4a81f30", "object_relation": "sha1", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764789711, "uuid": "a087324a-583b-49bd-8884-b2e948b527c3", "comment": "Malware payload (AURAStealer)", "value": "82f598e997de3e7527dca0ce467ecc1deb6a6ad78b628cb7adbecf9defb00440b9b8e422b6cc3aff638f886bfec0f393", "object_relation": "sha3-384", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789711, "uuid": "c966f838-3c6b-40c6-82aa-61fc296bd0c3", "value": "T13C87233ACB1E5080FB4782F3F2774AAD40F75626219AD4A67B28E5064C5FBE05B33746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789711, "uuid": "b3ffd3f4-0385-450c-9430-75fa9f5799c5", "value": "786432:dTTub9ktBqwVpZCVGXPGrXhQOsYseq7/oiki8CVUgH0j8:Fiu/FjYxQ7Y6Miaj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764789711, "uuid": "18ea8d49-933e-487a-a369-ade404a0a14f", "value": 36603612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764789711, "uuid": "09d75550-367e-43cd-b666-d560805bf525", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764789711, "uuid": "3f520e0d-76c9-4dda-9926-f849347bac15", "value": "(2) Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb9ecc7-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749469, "uuid": "4acf334e-32be-44cd-b548-4ed4b6dc0be8", "comment": "Malware payload", "value": "4ad646edb72cd8ac09c207e3f844e9f2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749469, "uuid": "68174cc2-a32f-48a7-9114-8badf514ac89", "comment": "Malware payload", "value": "d427181742726d50f8f26987083ee48b014fae8ac7ad124a90a9a88720ded352", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749469, "uuid": "7aca216d-f0c0-4f46-9e3f-f73d3860a471", "comment": "Malware payload", "value": "8031837e0e34d705ce9969c36d8949f2796e6356", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749469, "uuid": "4c1a153c-9596-4e05-b84e-e3c2ac6b0a21", "comment": "Malware payload", "value": "322764a286b03acd9d928aba999352414bf7b66d7e29cde1496949af924dcf8efe54901dc731c88408456c9c9edb1107", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749469, "uuid": "be1c96e4-24b8-4043-be98-17df8e0ef7b8", "value": "T1A46633DAB0B7A072DF4884634362A5A08EB1F9C874C77B76535A13BEB04314D7336AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749469, "uuid": "b7ffa650-028f-4922-b5db-b8530208d7e1", "value": "196608:ve0x803+27lnUiGc+muxdpAARnCQrNqtm:ve0x8K+ol2+ux3AA8Qxmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749469, "uuid": "a151e0cc-aff1-4bd6-9210-18d0e99696c1", "value": 6755066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749469, "uuid": "2cd73ac5-e7ad-4295-a187-5c874139b7af", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749469, "uuid": "2517eddf-8af7-4daf-a913-5715ce26f8e0", "value": "3c7a829a_893c_4f02_a407_6b0918c321c2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc29f436-d010-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743128, "uuid": "26ad64a5-5234-46a0-957a-feb261fa5257", "comment": "Malware payload (Mirai)", "value": "05b8a660de40075f3a012e63a155218f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743128, "uuid": "4fd32928-219c-4499-a08b-4f6bfd29eb59", "comment": "Malware payload (Mirai)", "value": "d47c7b09f38b5ec663944b578f54acec59d7b5f142ba192912d84aea86aebe2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743128, "uuid": "8d357642-b9a9-4ff3-ab2d-c95f935bea11", "comment": "Malware payload (Mirai)", "value": "34aeeec42e8739feb1d4beed221ffd494e8c9a62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743128, "uuid": "830f1466-d676-48c8-b6ae-be3b7e61f2cf", "comment": "Malware payload (Mirai)", "value": "d5d09a9bf0422ff298b48989b1273529e25084b04ac3e1634f072a1eb8d521fc8d1f9d1b9b9bdfef083dd98e74bd569d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743128, "uuid": "c57421ea-b64a-4e16-9e3a-b2990c41f9f2", "value": "T1CD143A46EA404E13C4D7177ABAAF424A333297A4D3DB33069D186FB43BC679E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743128, "uuid": "8bf638b9-ba10-4889-9f48-33a3aa8ff4d5", "value": "6144:sbBMwsVxsBAOUrpxakSEnFFAinWfs1qgnM/94tr:sbBMwsVqIpxakSEnFFAiRbM/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743128, "uuid": "d8ec9d2f-3cda-4184-9065-364fcf1c86fc", "value": 206739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743128, "uuid": "9bdc75ed-0cf7-447e-8e8c-afc08486dc9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743128, "uuid": "bcc6704d-0a8a-43ad-a0c4-3bdf83ca3a32", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fd8da4-d04e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764769806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769806, "uuid": "598785ce-3787-4005-b960-54cc2e2ce257", "comment": "Malware payload (AgentTesla)", "value": "ee6ac60d4101d872f046ba59e7cc65b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769806, "uuid": "8e3c9fb3-bb21-4277-9012-1c73105284f0", "comment": "Malware payload (AgentTesla)", "value": "d4afec965d05ba32766a802f6611faa86405cb36b857b65de8d4c83b1f152806", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769806, "uuid": "2ade833a-13f3-4900-afda-dfbd66c22e1b", "comment": "Malware payload (AgentTesla)", "value": "f7597f56a1bd11c9cd2329c78282f5c7a30658c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769806, "uuid": "4a5bc46f-5288-4a76-ae34-ed141410613d", "comment": "Malware payload (AgentTesla)", "value": "2108e8727c3f0ce9ff38418dc7ea82d29206ed40f181d2310885c8b12a806ca4595cfb8f3bc1c1a2bfe62c8bee3da665", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769806, "uuid": "4ad1bdd8-d6a8-4606-969a-6bcd71c25751", "value": "T18C95D07BB122CB6CD0CBC9B824E396F21D307E240AB5124656CE175F2AB3D906D5D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769806, "uuid": "b74f5078-0469-4b5c-97ce-c6d7b8301dd9", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769806, "uuid": "c01f2a28-1ee4-41bf-955b-c4c8eed6c04f", "value": "24576:zfs4r7YFz75ELy9vS9/aOHR+SfysstbokJMxqavDzWLyvt487diDxa/+0V:jsa7anKy1S9/aOHRnDUod1vDSLyh71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769806, "uuid": "d9d28808-2acb-4793-88ed-70c32a05412e", "value": 2038208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769806, "uuid": "78afc36d-81ec-4e0e-a861-ff3d9985ce8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769806, "uuid": "bfbef1e4-7b0e-40e4-adba-7cba3c35a757", "value": "cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef42264-d007-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739159, "uuid": "1900dfa7-c2a8-4226-a44a-8358e18038b1", "comment": "Malware payload (Mirai)", "value": "087cc2881f6990cfb7ae05927a455ca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739159, "uuid": "8e34b747-766b-4f53-a30d-f6e692d28101", "comment": "Malware payload (Mirai)", "value": "d4b3b178c6785a226abdc5905bd60b485117821d6d3e03c869a9158d34027c20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739159, "uuid": "869bf0cc-3c66-4004-988e-c42e219140c6", "comment": "Malware payload (Mirai)", "value": "ecd809f0380bd1a6954ed0329fb5b75d8c0410de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739159, "uuid": "60b3961f-1d7a-4586-817c-c1f7a06c2ced", "comment": "Malware payload (Mirai)", "value": "04518bb395c5507c6ac0d58efa859feb2c3b9e7811f3536c909a554a682f9b661d6713bc07c587277a7e1c5c21f9ace6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739159, "uuid": "f4b4796a-9246-4874-8bda-78313bce10c4", "value": "T177E31886FD829A2EC2C31BB7EA6F228D332553F5D3DA7103C95407657ACA54E0D27B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739159, "uuid": "f67135c0-89ab-4ed1-8892-fea638c42944", "value": "3072:2URJFt2GiKAHMuA/jty+hQgpwgeOhEy6hh1jq:2iJFt2GidMu9cpYOqVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739159, "uuid": "52c5d128-2512-4624-b5da-3a538ccc9d81", "value": 149340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739159, "uuid": "6525b945-ef66-47ef-8600-4c4d53e99460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739159, "uuid": "e5086853-a913-4b5b-85db-2f243bda3fe1", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd24fc0-d015-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764745013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745013, "uuid": "2364983a-c45c-4046-bd01-0e297fcf326a", "comment": "Malware payload (Mirai)", "value": "b3bc771e6d18d438bf71d3cd9a9415f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745013, "uuid": "dfb8a454-244e-4d1d-b086-3e27345fbf84", "comment": "Malware payload (Mirai)", "value": "d4c6fc6c232189102b241d17bd435fd3314d05a58500f3a324f7ea8d7454eb91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745013, "uuid": "4c54125d-398e-472c-8cef-d4ea35398831", "comment": "Malware payload (Mirai)", "value": "8af9dd05bac369dd955c970bae11fcfe3f2b17bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745013, "uuid": "10d34c10-abe4-45fb-9f48-370f00adcea0", "comment": "Malware payload (Mirai)", "value": "a18cbcaca804ec1f997d4d46017c3b20448ccee5b961e43c0e322f3d59ae4ca94c01e2b261ccf3574f74bba8f9528a5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745013, "uuid": "3040adea-c920-4451-b1e0-582f612d7480", "value": "T17113F1A1F31D6E87FBBE03B21E94CA974390AFFD788D40817291AF16BD6893527050D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745013, "uuid": "756f441a-f6eb-4168-812c-c88f7cb5741a", "value": "768:DW6GXlnYa4wd0PCJ8L8vCgR7P/lfvKZsuhKqKhBmW36068aBHjTdUd6LrTtkzFmz:j2F4waY7BlatKB73/68aBHjRUd6LnSIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745013, "uuid": "97abdf07-cd44-41e9-a30c-206b150b0286", "value": 44552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745013, "uuid": "f0990971-c086-4425-83e8-0271116a7813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745013, "uuid": "090a320f-0243-431b-aaaa-b6bfe38359d3", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a7caca-d099-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764801641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801641, "uuid": "9af0f354-aff8-4a0c-b1f4-5debf002bd83", "comment": "Malware payload (Mirai)", "value": "8d87e1c868fa4074219cf55d5d69e0ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801641, "uuid": "6caa5a08-bdd3-4ff9-b31b-6871e2eb82c9", "comment": "Malware payload (Mirai)", "value": "d4f84b1945a67c1a29771588da2fc1e3701abdff504c0f0b436e38918393d356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801641, "uuid": "812db49e-d34e-4ce9-ac09-274253ff4732", "comment": "Malware payload (Mirai)", "value": "9c09b4681167fdcf39d8533eec60b55214e474de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764801641, "uuid": "bb1eb1a4-de56-4ce4-9398-ef532a56aaaa", "comment": "Malware payload (Mirai)", "value": "6353c7721b2138a726d6947588b12310c2e7de2e79be485625cda3c1d7ef6d2b7059e26711c72d5eddd6fe639ee55a88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801641, "uuid": "504a3705-5b04-4f2c-9332-cbc2b6a59104", "value": "T191B34CC4E653D4F9EC0621342137FB379E76E1BF2329DE83D7A499366C92942C409A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801641, "uuid": "a9b9690f-53f0-44f7-98e7-ff436a858797", "value": "3072:hvCulDl79bmjmpLbNxln7yrXCjYBrixA:h6ulR7RmCp7gSWix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764801641, "uuid": "1b79a847-3123-48e6-aa93-1cd1651b9696", "value": 108016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764801641, "uuid": "bee37314-6ee4-4053-95ce-3b229e3f4037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764801641, "uuid": "812c206c-5ab2-4a4e-a575-a8957fc32d93", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f2be43-d04d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764769288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769288, "uuid": "5d936958-743f-4ca6-92c9-ead546c33034", "comment": "Malware payload", "value": "3b59438952422087cfeef79b93e2bfde", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769288, "uuid": "87e30155-7ed4-4bdc-823a-770002b26cf8", "comment": "Malware payload", "value": "d569037efb812bbf3b125eac0a17d77ab1d68406dcfad73288d6a7a07a6f4415", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769288, "uuid": "2171bc27-f093-4d59-b7f5-2195d7aa665a", "comment": "Malware payload", "value": "e45fce07e6fe8acb717de011e3d3838eec63878b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764769288, "uuid": "5ddb335d-c7bc-4282-bfa9-ddcffd8fc41a", "comment": "Malware payload", "value": "b8f8629668ef64fb0080a8b9c1245dd226b1515379987aaffbb45a757e1bc79f89eda198d8372069a4b5ab6e0fef9f00", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Zhytomyr", "colour": "#BCBF47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769288, "uuid": "cc22da33-cbef-43e5-9a1c-63aafad68466", "value": "T104715820B6FC0225E3766A776BFA916B4431B811BE1E8E6C0180C38F3915E59D971F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769288, "uuid": "8f362b6d-ff44-48d1-85ae-9964c8aca466", "value": "48:8W3pOm2eOC+/5CrAApZxfnA+LXPC1lTUymbNwDd7f89vCf8vWZ:8KpN2HkEqtHNjVvWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764769288, "uuid": "e73dd5b9-8611-47ce-a8fd-6efd1db47112", "value": 3808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764769288, "uuid": "2511ddf5-6078-4c5d-8f2e-80dd03176133", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764769288, "uuid": "efbd121d-9687-4a02-90f0-1ed20962ca99", "value": "\u0417\u0432\u0435\u0440\u043d\u0435\u043d\u043d\u044f_\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0438\u043a\u0430_\u0423\u0421\u0411\u0423_\u043f\u043e_\u0416\u0438\u0442\u043e\u043c\u0438\u0440\u0441\u044c\u043a\u0456\u0439_\u043e\u0431\u043b\u0430\u0441\u0442\u0456_\u041a\u043e\u043c\u043f\u0430\u043d\u0447\u0435\u043a\u043e_\u0412_\u0412 \u00eclnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45362d92-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767356, "uuid": "4ee750dc-510a-4ebc-8b51-140b0a778c68", "comment": "Malware payload (Mirai)", "value": "2197c90a0807e4cf48e9dc6535ae6169", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767356, "uuid": "e03acafa-8068-47ed-8dd5-373faf8052e3", "comment": "Malware payload (Mirai)", "value": "d5a52ccf5ecc1b39452b57968172e75f1ed3cd26f6cbba7b10b3b809b71a1191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767356, "uuid": "65746855-076f-44d8-a376-18f9f4b553d4", "comment": "Malware payload (Mirai)", "value": "5f4d9cf6823e3c8cd14913adf3eb795932697749", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767356, "uuid": "08784e7a-1ae4-4af9-9ead-aa30512cda95", "comment": "Malware payload (Mirai)", "value": "c629a0dca46c1618be42548b1e396f515f378764a1520d01bcbd242545ca455e156ee1f696e9d61664797c62b885e0fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767356, "uuid": "c836f211-385e-4d26-8996-f0a937747cd3", "value": "T16B43F13DC1DBEAF0E61276B9D66DD11824471B3AE1FD7C832A141A583C82D01BEC888B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767356, "uuid": "ad754cd9-585d-4751-9a7a-8b6bd0d42afe", "value": "1536:TPS4tGgJSkuKmqihVvoGeHz+gs3SWiLCYYH9rk:TPltGVxXq6J6s3SWiLCYo9rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767356, "uuid": "e7dc1aba-d206-4373-8098-70fdb83c727d", "value": 59072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767356, "uuid": "94a8ab59-b0a7-4034-9a22-372901fb1a95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767356, "uuid": "261ce515-4138-40fc-8dea-fd9cda6130af", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f73320-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767364, "uuid": "324c01a3-8544-4dc4-becb-d1426416093c", "comment": "Malware payload (Mirai)", "value": "c48c3217f62444fc165827e21c3af694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767364, "uuid": "fe2e450e-f0a4-4e60-9972-7dbb934eed62", "comment": "Malware payload (Mirai)", "value": "d6af828cf443eb7ab33b1c83b73f8fa00d379b05eed760f89b9d88357fefe5c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767364, "uuid": "012800ba-f62a-4e83-8af0-f3f296bb5886", "comment": "Malware payload (Mirai)", "value": "3e176d4605283c344d3d9711200e61f219756780", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767364, "uuid": "ae2c8597-0014-48d7-88b4-e95aa1b84571", "comment": "Malware payload (Mirai)", "value": "bfb09e607f15002cec2e64933ea2d5483dfa39341f3d1c674776d968d45e67c2cf47dcbf3613eb988288b68f68fa3f0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767364, "uuid": "6791593e-3de6-4cdf-b3a9-be3e6563df7b", "value": "T1207329DBF800DD7DF80ED77B44530A0AB270A79106931B36635BBA67FD321A55822F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767364, "uuid": "d3632e5a-f479-421c-894c-b5c7e31ea54f", "value": "1536:z3OL3wr34Qu3EhvOy0sxomD5FH4ZWp6wtwb48FyRXFORZkRawHUzN6NzbotcuObI:z3OL3wr34Qu3EhvOybxomn4cp6wtwfyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767364, "uuid": "bebc9d1f-7818-4153-bfbb-cd9d0ef9999e", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767364, "uuid": "22fce52b-0c90-45ed-a14f-f4eae7a3acab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767364, "uuid": "269901ce-7423-4dd7-9404-e758d5084e0b", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23c6f77-cfec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764727703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727703, "uuid": "0968c7b5-5b4e-46fa-a5f4-9096e2f3c350", "comment": "Malware payload (Mirai)", "value": "36c46ad3d4d80b0857a7e6e0e2f5704f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727703, "uuid": "f9225e5f-46ab-4936-8e47-1d1ed3e7ac0c", "comment": "Malware payload (Mirai)", "value": "d76389ced6f9e7ae2797785db409150b6a20cfee3b51dae999b0510b038399f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727703, "uuid": "614c0341-5553-4181-95cb-922e39f55b6d", "comment": "Malware payload (Mirai)", "value": "52e5a00149d0ec57adbbfb8f7a89b160a067ac41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727703, "uuid": "bc8cbb3a-5b78-469d-85f3-6dfb294d4934", "comment": "Malware payload (Mirai)", "value": "3447faf8b86637352dae75e844532c3e964f82a7a4971220d8c30b8f19924ee8c16693d0fd872f7a5bc843a360c0ccfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727703, "uuid": "454ad46e-e19b-4f69-82e4-20d4bc1d2895", "value": "T110E3E916EB210EF7D82BCC730099278524DC436B51A97B77B938C864F99A58F46E3CE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727703, "uuid": "ef29e022-6aa0-45b0-a7b1-d17ad02ae810", "value": "1536:XDurprBTGTBq5998AGPndFli88hSXJcFvzzF1wRUpfM7V2a+wmFHwb0TmZjVYZPm:arp9TGTBqZonJibUX+FbzFy0HaYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727703, "uuid": "1bd0e402-3755-4053-a8e8-93985612277d", "value": 151188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727703, "uuid": "941e3d79-6f16-408a-b61a-0a7c77a5f898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727703, "uuid": "7df7bd13-d170-4c9f-a710-95fafdbabf01", "value": "m2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271cfbc3-d0a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764805101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805101, "uuid": "2bef9b96-30e1-4f8a-bcc0-36076a8fe9fa", "comment": "Malware payload (Mirai)", "value": "ff1f545e817a88fe5276b4e89a8eed3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805101, "uuid": "ceaf84b7-194d-4a60-89d1-c38675082843", "comment": "Malware payload (Mirai)", "value": "d7903dad9f0ee1cb2acf0933b6fe661655e695a464c29957a9833ae2410db984", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805101, "uuid": "eb11df15-77d4-47fb-a17a-6cd72410af4f", "comment": "Malware payload (Mirai)", "value": "41ecc195934b7730c2c448e2bf6271821df13318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764805101, "uuid": "c6f90591-9b3c-4254-ba28-7d3b6070c4d0", "comment": "Malware payload (Mirai)", "value": "61a28e67cf841362158f9709b5758c544ef3bf03d153e07de909240d766007fa65a4743fed0bea0e0e7fd9af65677207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805101, "uuid": "f92d196f-f6e9-471f-93a2-6b2e62785317", "value": "T1CB23F29B3924489DC045C03967DA4B652F7017D2EF81B8120D6AFBDE4A0D1ABFD43BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805101, "uuid": "b1c9b995-d9d5-443c-bb6d-3ce344bd50bd", "value": "768:0t5S/TLewPwBLgMexqST++7b0Hebq6VslbJ9FdBGiQhA5cpT2iZsA9yRbi2nZBAC:gCTLNmLZ+7xq6iBGiQhFT2aT2ZBAVJuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764805101, "uuid": "5fa43f16-5257-40cb-b89a-0d6c536b9a17", "value": 47664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764805101, "uuid": "c67e3b7a-329e-46d1-adb9-178e6923326d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764805101, "uuid": "694a1f97-94bd-447b-91ad-c23f028c60b0", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e868c620-d03a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764761187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761187, "uuid": "1b99d54b-f5a3-4720-a7f4-d52ee3300200", "comment": "Malware payload (Formbook)", "value": "a86b79afa4880b64e10c65e20f3b2ca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761187, "uuid": "5d221274-3d4f-4c35-a6a9-a328440af914", "comment": "Malware payload (Formbook)", "value": "d7c47e0080424c58241a7d24bbd94a9285d4763215f31ca1a0bf6af1b503929f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761187, "uuid": "b4a410d1-cc2c-430d-9854-734412bb809d", "comment": "Malware payload (Formbook)", "value": "206c858b350d286d682443cf578419fb2ef957a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761187, "uuid": "d6558e21-beb0-4054-a611-2f0c8d977ed7", "comment": "Malware payload (Formbook)", "value": "08a233095ca5fbbf2e6d745406b5588c07969d12df48fbb50421f62c0a2e6d89a8987f73302a940e8310434f94a3bcd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761187, "uuid": "7619d11e-bfe8-4812-aaf8-f565e09cd0f8", "value": "T196F4230FAA249F51C54EABB3C417C34888E8406FF531F3921DC658E20E75B65C69EE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761187, "uuid": "d2b476b9-890a-4c8b-9c32-9c2763c88c48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761187, "uuid": "aac77f52-d4aa-48bc-889d-cb51d89054da", "value": "12288:ESdUmclyfHMFv/1Tt1PPzbuWaSFLjYeFCkzkvWQLgr/7Rb20qTc2CJ/WnYjv60xO:yhyfHEv3zyte0kzkvLm/7RjzF+4ZxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764761187, "uuid": "161b09b4-a1e6-49f0-a3a2-f34e1e2fea10", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764761187, "uuid": "0566f8d5-310e-4f7f-9e45-888ac53f473c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761187, "uuid": "bb1cb08e-fefb-4bbc-94e1-dc515a949585", "value": "d7c47e0080424c58241a7d24bbd94a9285d4763215f31ca1a0bf6af1b503929f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82edcc9-d009-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764740114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740114, "uuid": "44d61f4f-1f7f-4326-987d-cbd8fb101384", "comment": "Malware payload (Mirai)", "value": "4d3a7067ddb5b0c1fa51302213dd7321", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740114, "uuid": "dd788709-5b42-476f-b944-91b5e0992246", "comment": "Malware payload (Mirai)", "value": "d7f97868d24796064c6af011655226995ed04cf45bccc7b33d8e91803f8b1525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740114, "uuid": "c5e589e2-30f5-45c8-ba12-320031bccf3f", "comment": "Malware payload (Mirai)", "value": "e0fc5abc19af5fa2bcfa5bd55d8fb8875b6074be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740114, "uuid": "52a6e031-22a8-4b60-9d77-92961658cb8d", "comment": "Malware payload (Mirai)", "value": "854ce5f982a1fa130ce58eac0887f74b0e78860c1153ebf7eaaefb225d0dd96c300c0534a45d50c84616ce3a74740852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740114, "uuid": "874e9be8-2f52-49a7-a715-9d5148a26405", "value": "T11D03F1BC051199E6F24BC9F1676843E32E7606E42DC7CA8BF48762966C42DBC7C136C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740114, "uuid": "fc3833ed-71e3-492f-ab8d-0e633115c771", "value": "768:X0a1VOGD3VRt8pKCZhktQo7nYEKVtzXt/J45Shz40GlBijFU5c+JgGlzDpbuR1JC:NHDlRt2KC8Fn9KVtzXtm4hzbMBijYVJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764740114, "uuid": "ea783e81-76ca-4aaa-becd-c945d0445ae9", "value": 40060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764740114, "uuid": "34f11a04-01c6-4dcb-be84-f0a69199b7b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740114, "uuid": "1a613eac-c459-4a98-bd24-a54aef24bbde", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda0612e-d093-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764799448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799448, "uuid": "b0cc2c6a-e700-40cb-a4e9-5aa39364dc47", "comment": "Malware payload (Mirai)", "value": "6d9cdd517894e2e9dc3ca3f8e20c8007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799448, "uuid": "5fe72499-8a9e-45b6-9d1f-5f68f95f2e44", "comment": "Malware payload (Mirai)", "value": "da787310312051f7e84e52b52640cb308dca4200f9c95b34fc9c76845e74381b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799448, "uuid": "d5bcc87b-91bf-427c-9c64-85b1e65bce5c", "comment": "Malware payload (Mirai)", "value": "bc5d6597eea69e4f7fb3d71824ce9c039291313b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799448, "uuid": "e5e2d98d-13e2-48ab-870f-655eae33e6b4", "comment": "Malware payload (Mirai)", "value": "a8bda48fc41b7815957e3b37521c5b414430661ca186af6c375842fb1e60ebfabf7b1c468480d2347b253df6686b5540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799448, "uuid": "5b2e4781-3477-40a8-beea-72d08bc1956e", "value": "T1DA13F2F0C1A5EB6ACFFD7244BACC50837FF167482996C992F5A81A31A973452A1187CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799448, "uuid": "f509acfb-9819-4354-8d6a-7a11cc38aa1d", "value": "768:yAM9+7a/W8FIDOEUU+TR7KBbX71oXzS/t94kb/A77BVSq+mGObu4uVcqgw09E:yAQ+7TbaB17E31UzSFukbOSvmZbu4u+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764799448, "uuid": "088511d6-d98b-4958-8af7-805443f19787", "value": 44332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764799448, "uuid": "5844fe15-e966-4742-986d-ec09a6a06eac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799448, "uuid": "453b252f-bdd1-47a4-b9a9-7d89ca215372", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402bc89c-d02a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764754033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754033, "uuid": "ee48f7a2-c9b8-40af-bf8c-e2ca4dd02a88", "comment": "Malware payload (Mirai)", "value": "0baee10f82bc6b03b4d36a6e110ee18a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754033, "uuid": "488d9e53-b84a-4fa2-9add-dcc704c69ca6", "comment": "Malware payload (Mirai)", "value": "da7c1ff838784afa7fc7573d36da338a5589d85dfd92ea0ea1cbd25f9bc5f084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754033, "uuid": "3a81bdf1-b20b-417a-87f1-d12160608342", "comment": "Malware payload (Mirai)", "value": "7b24ed0179bf1dfa7411812c8d1ffdeaa5010b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754033, "uuid": "63269bee-c5de-407e-84cf-222cd2f7b3b7", "comment": "Malware payload (Mirai)", "value": "299b767ecccb85ab7ad5febfa9f43bde360ed5c5fea6a57665fa8efd713dc5561b49e0e334d05f0a4ad0db608804ac16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754033, "uuid": "8ef52e37-f027-4fae-a97e-12699dbd733e", "value": "T17E13F14B754E830CC25E09BC15DF96C9AC60D42C00C429C6A2D5393A7DC2E2BFA597EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754033, "uuid": "e5be6790-7f2f-437a-bd92-c8a74edb999e", "value": "768:M/ESvenmumfSNgGN+gxXz/Bjjb7S9SnbcuyD7UoQRjU:M/FWnmKgGN+2Zjf7Sonouy8oyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764754033, "uuid": "616ab1c2-60f3-49e2-b15a-0b986eee550c", "value": 44812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764754033, "uuid": "e63aa3a9-c74e-4b24-8d11-d3ff321ed3fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754033, "uuid": "0b3d025d-5faa-4b5d-96ff-74445d2c79ba", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90c7765-d01a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764747417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747417, "uuid": "f8d64122-d030-4bfa-a23b-626e6d034344", "comment": "Malware payload (Mirai)", "value": "f15deb99c7e9dd74d4086de7d7b5d3fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747417, "uuid": "f726fe51-1269-469a-8016-5320e59c77e8", "comment": "Malware payload (Mirai)", "value": "db1e13252b2ac9000b3c34ddd1886e09bb76c27bebc01037a87ef057a8c8d0c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747417, "uuid": "890474bb-7423-457d-8ffa-d4b3c74e7ba8", "comment": "Malware payload (Mirai)", "value": "c12dc9b985f0ed5a03e90e93d64e634aed477941", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747417, "uuid": "462fa4f5-0d22-4e44-b47b-a7789a1be2a4", "comment": "Malware payload (Mirai)", "value": "4d6ecbd441f3e760fc1fd67755248047c5499b5c14867da448a335e30b09d579b3a1cec74766ee1c5881ced29d5cd911", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747417, "uuid": "1ea121f8-e97e-4d85-901a-752afcf4c9d0", "value": "T1FD5181CB45DA97F4DDB5999171E949046CC2F297B4C3DF42E9E824A88C8ED8072D0FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747417, "uuid": "8edbe8b4-642c-48e9-bfcb-921ca2a2ba97", "value": "12:q0F2ZkNPTFKX0F2wkB7TFKX0F2oiko4fTFKX0F2RktTFKX0F2QLkQ2hVDTFKX0FA:vXUxtUcfYh77q6I0TVL2N2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747417, "uuid": "6bd5db33-66f3-4dec-ac04-748e10a8a390", "value": 2698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747417, "uuid": "bc0f027e-e510-4425-87a6-92a4090bcd01", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747417, "uuid": "18bf35d8-10c0-4fbd-9cd3-f79a2516bec0", "value": "hnap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e5b538-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806335, "uuid": "2f18a560-3dd5-43bd-b322-e4e2fb2740fc", "comment": "Malware payload (Mirai)", "value": "2ec676c69dd2880c79567c414b6a91ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806335, "uuid": "9644191f-e28a-47e9-aae4-9ddebed46ece", "comment": "Malware payload (Mirai)", "value": "db8349e21e4a6c52de6f724df4b08f3b709b50274763ec69fc93674d822f3df8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806335, "uuid": "e2ca0155-a0ca-4fb1-9061-f6dd2329b3fd", "comment": "Malware payload (Mirai)", "value": "0f934e56407e2449aa95822892dd59aa10ac277a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806335, "uuid": "21e54ccc-c616-4b01-accd-591c1e6ec70a", "comment": "Malware payload (Mirai)", "value": "49d230dfbc556a98ecc44591193de5be4b984d85d1e86eee40414f52785e11b0a2c3e50049e7ea14357d86e34cef5241", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806335, "uuid": "c485a377-43d3-44fc-90c1-b5c722b51dcc", "value": "T14213F14532671D6AE74F023809DBAF8F6C30C40A519880B8F788F7F7C404B75B62A6E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806335, "uuid": "c75bc0c4-2115-4ec5-84bb-5016a9d5a9d2", "value": "768:+W5s9FFYUfQeTQuZCNobBH+yCFjY+trPJoVTJH8nbcuyD7UHQRjE:Ecgz96eWrPiVTOnouy8Hy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806335, "uuid": "ddba0260-24cb-403e-8ad7-3ae3154dae89", "value": 42212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806335, "uuid": "b2888935-6f41-4360-8a3e-e5508062900a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806335, "uuid": "3136d807-8473-492f-92d1-8c7bd575016d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008be2c3-d079-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764787856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787856, "uuid": "0790be44-676e-47da-b6e5-656b201222a1", "comment": "Malware payload (CoinMiner)", "value": "ae5e625b1ffbda1e72ff46e4ba8cdb03", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787856, "uuid": "bbf097f7-262d-49bc-ae0d-5c2bddbb0eef", "comment": "Malware payload (CoinMiner)", "value": "dc65f0146c1e3fb47907090f3d64664215240908c133416d8c69f69967fc9ec1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787856, "uuid": "94921400-a970-455d-9d93-ba8003aa4487", "comment": "Malware payload (CoinMiner)", "value": "b2d18600a75a7570620f085523979b314ebdfd4b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764787856, "uuid": "ea907552-d95c-4148-91da-bf997319ce73", "comment": "Malware payload (CoinMiner)", "value": "b100f7653d1a1848e1847d2ffc28a8691240682b5ef69372e9c9597443b2866c3e4e0f5c52888a948374f75725681aef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787856, "uuid": "c01072a3-57e1-45e0-9141-80fdbe461eee", "value": "T13007331D9A0D4AA1CFE822BA6E987CD32E424CC1949CFA6C369FED582377D148C37355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787856, "uuid": "576bf8e3-2c5b-4b47-b5d1-9d760d093f40", "value": "393216:ZbD8FpUocvWusR1QALmMe4ieMEqDgDz9UcVsSgci:ZbDm4uLm5ZZrOsbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764787856, "uuid": "fd28a4eb-f1b0-4128-9ccd-9c951dfd93da", "value": 17897472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764787856, "uuid": "c436e894-1c85-4910-a861-38c524e82b71", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764787856, "uuid": "d2eae05d-5db6-4a3d-b0c2-b5ff0a45abe8", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87824def-d046-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764766178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766178, "uuid": "77cd604f-79df-4655-882f-1c8e63ffa4bb", "comment": "Malware payload (AgentTesla)", "value": "f2f3f314bb1065195e7edc10429526ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766178, "uuid": "9e005bbc-9eb6-42ae-998e-430fabcf4a25", "comment": "Malware payload (AgentTesla)", "value": "dc8fb465d9b20ffd3e35e6b505ccd3ba82eb752f7ee2840a13ff4975dfaacaca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766178, "uuid": "65db71ec-bfa1-4144-b8ff-52f8a816b988", "comment": "Malware payload (AgentTesla)", "value": "d941d059e1cae3410363d4432742b433883d0fe4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764766178, "uuid": "eac85346-1a54-4f2f-af22-e8bf33a0c4b5", "comment": "Malware payload (AgentTesla)", "value": "e124f6fa0b23911d06ab5f3628c60e819ddfcd4fa95bf18583ee53ec0572af85bff399095718a23f2ae840c4fc2a9512", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766178, "uuid": "5d0d7cdf-f947-4fea-89c8-7778c60b7e41", "value": "T13341A8187ADE5731D3768A3758B6E3118A36BC51ECB38B5D11848BCC3867610EC65F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766178, "uuid": "15b8ce1e-2aaa-4365-ab5e-4a0ddd4fdb8f", "value": "24:8tJ/ByUl1+f2EMleYTxDAiH2JCFfhib4AlJFL4I0apgAlVu1ddzS/UtLFhwiXQ6G:8zeMgmUiWJbbNruIA31V1XCi3WzFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764766178, "uuid": "6f749ed1-0fe1-4953-a998-d10169a7fdad", "value": 1941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764766178, "uuid": "347bd5e3-1020-450f-a203-19a2e97a229f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764766178, "uuid": "8f53190f-d30c-4ce8-a97f-dba8064fa3f5", "value": "RankupServiceFreeTempV6.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd237f5d-d096-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764800682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800682, "uuid": "ea0eb7c6-10e5-4a30-aa83-04d3569c89fc", "comment": "Malware payload (Mirai)", "value": "722f5e6c0ac73b072849d6ef68e6f373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800682, "uuid": "7eee242e-8ca7-4fe3-aeb8-e5f0a342477d", "comment": "Malware payload (Mirai)", "value": "dce4f4bd10ff192033fb20e9b2443a3965bdcd456ff0c1048e371151ad9ba4d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800682, "uuid": "0c84c31e-2014-48f4-af19-598c5c7cf343", "comment": "Malware payload (Mirai)", "value": "641c75509c7350740b5b2f056be037b9e6d61be5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764800682, "uuid": "7cd3537b-f450-4a31-b7c0-7aeae7619624", "comment": "Malware payload (Mirai)", "value": "a7d28400069d899e40ce985a6c64b897e506e4527b5dcff1703aad6fa7ec801e0563402c15eb488ded7f39e18242e668", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800682, "uuid": "64319b5c-b840-42b9-8dc8-09d55a2eed46", "value": "T10623F16FEE186885CD5C68B1236956D2AD6460C1365ECBDEA3290D90CA732063DEF3E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800682, "uuid": "6b1b43f4-e290-4b9f-8b1c-5f625eb86136", "value": "768:t5iXeMKbg0d5hMDS7V2tEvdZyeQli3KeEciYAhM9xe7Gt+yE832Z0G5BN+0tIqsm:mXeZh6DSJLZyvlOPma46cyNKHV+0tIqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764800682, "uuid": "966a712b-ecf6-4249-8794-b0092728c863", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764800682, "uuid": "1f41da08-d8e5-43a9-8ffe-33ded0c978c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764800682, "uuid": "19b70ab1-4f53-479f-9754-019010dfd0ca", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8216adef-d03a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764761015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761015, "uuid": "21e2d468-3ab4-4fd5-8a1c-570d0e6a6fc9", "comment": "Malware payload (Formbook)", "value": "78f64f0076dcd24d68725a0f95ceba8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761015, "uuid": "a420009c-178b-4127-b1c4-6e1bb4b8d0d2", "comment": "Malware payload (Formbook)", "value": "dd8a4d03bf1729bd7cb717b1e6213663853570d73c1112459e0db5558a5bb479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761015, "uuid": "c4d820f9-a72d-4035-bb04-942e7af06e39", "comment": "Malware payload (Formbook)", "value": "ff7a4c60e1bcb18186b1fb8fa4a18069925abfd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761015, "uuid": "0e588234-f7fd-4b1e-937f-b653f2e2fe81", "comment": "Malware payload (Formbook)", "value": "5fd421e7bdccd09a71b8e580d28cdb91c4ab39bf4ed16e8973d4868c664e04f4ad62aff8470ebde19a587347f4b3c02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761015, "uuid": "29379754-556f-4c4e-97aa-2fa90d1ed88c", "value": "T168F40219126AFE13C5A51BF408B1E3B953B56ED8E111D3438BEBACEBBC1DB017914392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761015, "uuid": "a589ad48-a99c-4ede-98de-018e5dee33a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761015, "uuid": "5bdb3235-e11b-4aac-982e-ac3c6c211d6f", "value": "12288:y8G1pbvjU4KHdvbetqBgxOELUnszicNmi3jzVonhZHZEJqVO3AleQ790CcF:C1ZvPKHdzet5xrLUnsznNm+jJoJVEAVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764761015, "uuid": "5ed557e0-7e0d-429e-9798-356aa067ba28", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764761015, "uuid": "1d169548-003a-4729-8c56-16b5c8d2da7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761015, "uuid": "4f44703d-2aa4-427d-af36-38134b60cf2f", "value": "dd8a4d03bf1729bd7cb717b1e6213663853570d73c1112459e0db5558a5bb479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d9cb86-d003-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764737565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737565, "uuid": "d71209c4-8125-491e-a57d-9bf27fcb4e8e", "comment": "Malware payload", "value": "de39a59ea76929222f88d1c6e431e3e3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737565, "uuid": "534c0eb1-d0a5-42e0-b6d4-fb26aecc58a8", "comment": "Malware payload", "value": "dea34c85670c84f41f59552800011f1a2f44a6304d80b1f0127fc13a08a86e50", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737565, "uuid": "aaad2f77-b2a0-4737-aa85-cb97a55e9ba3", "comment": "Malware payload", "value": "d316de8e53f44630865996ef587addbcfdd94310", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737565, "uuid": "ae2e36b6-1cfa-40f9-bf7a-cba4a33ed944", "comment": "Malware payload", "value": "a687803eacbff0152b40e57736450098cda04572bf79615a9edcbe661cdd4fdd8edc6bc642130af828f2ed39763750ed", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737565, "uuid": "dbc6eb54-92fb-4aca-ad8f-7b8f7555734c", "value": "T19773439C09CB45F85A3BB4DC8BDFAC02FBBA8903255CC5A5FB4D98906F1182852F47E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737565, "uuid": "c334e1d5-4ee9-45f7-9313-c4e8eda01833", "value": "1536:aaLZci4DtYh0y3r3BvamoqwAqRPpzRIxN8SJUVcOnGWCmsmmOPCfyZPi/WLqvoGD:uRDyhp3r3Bvamoq0RPpzRIxN8SJUVcO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737565, "uuid": "b45d5d06-f349-49ca-b866-0c4cb0c5cdad", "value": 75684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737565, "uuid": "1aabc4a4-db2d-4eff-b6d4-9c2e25a45ac3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737565, "uuid": "82413dd6-8b84-4c50-bfca-cd6df9493517", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41a1858-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793795, "uuid": "c02d4915-7a41-4d54-addd-839d803dfeb4", "comment": "Malware payload (Mirai)", "value": "2c6c4bc4c76f59a91ef305c09786d94c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793795, "uuid": "0a0fc719-209d-4b39-8ad9-042156f5d82e", "comment": "Malware payload (Mirai)", "value": "deb70af83a9b3bb8f9424b709c3f6342d0c63aa10e7f8df43dd7a457bda8f060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793795, "uuid": "2d1e4133-1966-4fc2-9e14-6ff656ab36b5", "comment": "Malware payload (Mirai)", "value": "2058d492437997b8dafd8859a6e1433902d087df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793795, "uuid": "852dbbb3-4287-4583-ad9b-7491da10cd50", "comment": "Malware payload (Mirai)", "value": "f5b9a36c0f0fc83cceb94b31ebf02a05ad16243b1f5f2c56c24468ffbcc0b1d679c5c83558f1c2004fb1f0c986d0d565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793795, "uuid": "0f9eb3b0-656f-416a-9640-960b5f146336", "value": "T1BA13F1F4C318A299FBCAC57A57F50F806E620FB43546DC4A3A56E943DC4A8B964533C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793795, "uuid": "ed018177-f2e5-462a-b03a-662cad2a1f45", "value": "768:FWFFVHO0nbMeuElmgWpuxXSx11lpBXtEBO4KzoAv+W2HgvrGuWA1Q7s1T2StIJgt:FWFDOUbMeuEUduRW1NBXyBO4Oo4+WRGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793795, "uuid": "d2fd1388-c48b-4c18-8ea7-481246077d95", "value": 44900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793795, "uuid": "c514bad5-4c0e-4fec-8923-979ab94cd717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793795, "uuid": "0572d671-1328-4dfe-8679-010f9ccf98c9", "value": "zerobotv9.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9de90b4-d01a-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764747338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747338, "uuid": "ff33ecbd-0c1b-46ed-b72a-ad92c744a687", "comment": "Malware payload (XWorm)", "value": "e9ab3246d4ab6cef550f7ea1d9f938e1", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747338, "uuid": "08dd1489-c295-4dd5-89d1-3d20237cc8dd", "comment": "Malware payload (XWorm)", "value": "defa2e29e45168471ce451196e1617b9659b3553b125e5464b1db032d7eac90a", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747338, "uuid": "865a16f5-99b6-475a-a701-4796d7299b5e", "comment": "Malware payload (XWorm)", "value": "c94fceadcee5745092a692cb9111f7b861f09c82", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747338, "uuid": "8f757e63-125d-4662-b36b-000c7fbc5173", "comment": "Malware payload (XWorm)", "value": "5b9fac010477668dec58901e68de9ba5f53d6386a89bd46ad396a035145f83a4fbcd979afe6ea9bfc9b1184952db2320", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747338, "uuid": "bbe32fa3-94b2-4f6d-a5cf-835f01ff28c1", "value": "T12302BF8BDB8097ADCBCE7F32B837121E771993A955188D668815D358CF5B288C42B13D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747338, "uuid": "500fc04b-7433-47c6-9478-18247b0d76f4", "value": "192:jqTz/4e3ep1a3Re+PxwkTpFCO7tdEcWUjywLfXXEjX+uKsxuQ:u34eQ1SRe+ZwkmMt73TXiX+uKsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747338, "uuid": "82f92494-df9f-4edc-9791-428f5c48bf43", "value": 8225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747338, "uuid": "0c71df78-b34e-4f8e-9043-d790758d4eb5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747338, "uuid": "cda0feb8-a047-44d2-89b5-9938032f16a7", "value": "Analysis_Proc_Report_Gem_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8c9f04-d018-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746406, "uuid": "7ad58797-3f9a-46b6-b5e5-37d8030bcb2b", "comment": "Malware payload (RemcosRAT)", "value": "60557b165bddfcb637dabf46077b36d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tallymostfavor-duckdns-org", "colour": "#F4BC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746406, "uuid": "4c31c8f9-290e-4bfc-8807-abb25146c074", "comment": "Malware payload (RemcosRAT)", "value": "df4bd0dd1ac15753d05c6467246864f096f274bc97b06ba2387fb2f81d6cafae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tallymostfavor-duckdns-org", "colour": "#F4BC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746406, "uuid": "2910f96c-84b6-4cef-a51a-bf33b113fb4e", "comment": "Malware payload (RemcosRAT)", "value": "62808455c9ecb739844ea35b3234d323fab7aa68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tallymostfavor-duckdns-org", "colour": "#F4BC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746406, "uuid": "40727bb4-a22e-4787-91d0-2ffad4aaf08b", "comment": "Malware payload (RemcosRAT)", "value": "23a6fed162d0c9ff61bc0686976a475a1be5631b3c705278559519709f9cda0924764569b3feb75ab073f53f1aeec187", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tallymostfavor-duckdns-org", "colour": "#F4BC96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746406, "uuid": "b29fd1dc-9172-4b25-80de-441e982369fe", "value": "T11566A50516F4249986FBEEA1DA2D6E90AD0D3D172AD10C4B792CB5AB306F45CB630D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746406, "uuid": "5fec4dd9-cc89-4806-8c49-f14fd093d9f3", "value": "98304:HXObO+lfTrm36V+x8DN9Jf2hj+MUIjA+l:HqPlfTWgkANb2hxDM+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746406, "uuid": "34433cd0-1e21-453f-806d-6019945f38ef", "value": 6562633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746406, "uuid": "b8ddfbb7-323e-4720-bb7c-6b437ee84aca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746406, "uuid": "efeb9c11-4178-4ba2-8bbc-c071b59fafbf", "value": "df4bd0dd1ac15753d05c6467246864f096f274bc97b06ba2387fb2f81d6cafae.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b112c6-d002-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736760, "uuid": "6356150e-e981-4399-8440-05fe327e3746", "comment": "Malware payload (Mirai)", "value": "88e1498886b2a522d794566f9d19d7e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736760, "uuid": "b3de8fe0-04cc-438a-83ac-5ae707b944f6", "comment": "Malware payload (Mirai)", "value": "df72770f5e13e72b75a9f126baf586bbf91f795a2f4380a84484d9445a6cc2b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736760, "uuid": "6fde3ae3-fc5f-492e-bf3b-ad44aaed81ac", "comment": "Malware payload (Mirai)", "value": "1b326c7844f79d9cd72d2cbba193ae68f50c33cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736760, "uuid": "6f1a1e62-97f5-4538-b71a-f154be4aa4e0", "comment": "Malware payload (Mirai)", "value": "ce167979bbd45dcb33c53881e58e80d44daa76c0c805854b540478452c22282ca66ee5c6882ff69ba18bbc0cfbb8e3b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736760, "uuid": "4f2000b3-d09f-4b04-89ba-1e995f27d947", "value": "T1CBF33A16EE50C0AEC096C1B86BDBC1B2B731F8B40321376F33A96E362E65E545B19357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736760, "uuid": "bb883718-fc85-465d-a2f8-a1494e184322", "value": "3072:QPxBrX+G+mvbxLnAXFHWhNkLvXFt3bPbeud1jvncISCLXIdrm:QPxBrXJZAVHWY773bPbrfczZdrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736760, "uuid": "1817b4a5-4ff9-43cc-89ec-8dd9c35fe84c", "value": 161304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736760, "uuid": "fa4f934d-c5a7-4342-8046-3a3721f74fb3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736760, "uuid": "91700d9b-c739-41c1-9b84-620943e3f569", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4345f78b-d01c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764748025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748025, "uuid": "7332aaa0-92b1-41bc-9ba4-a356dd475067", "comment": "Malware payload (Mirai)", "value": "8df057f6765f2003deaa84e7c953414d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748025, "uuid": "882874f6-4404-44e4-a1d3-7bd14367754f", "comment": "Malware payload (Mirai)", "value": "e05b8bcdc18cd00ab479cf0ae1255b41110c1c913b3415dc7063c480aa0e1de8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748025, "uuid": "da0903a3-fe01-4196-8109-155f6a0f6a24", "comment": "Malware payload (Mirai)", "value": "99cc3ab0d8c60e12801ccac4ee2faba8c630d7ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764748025, "uuid": "865a2e0e-57b6-4071-8d1e-87cc4a47b529", "comment": "Malware payload (Mirai)", "value": "614e34f585478a07755579aab35d298193da0047850989e54f7c9b86077343200d723a538981317f654f4c6f85c40fa4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748025, "uuid": "f419bdcb-131b-404a-ba19-713196607efb", "value": "T1BF5173CF01CA97F1DDB5999171E949046CC2F69BB4C3DE46E9F834A88C8ED8072D0E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748025, "uuid": "2ad9c1e2-b674-41ec-b591-70e580e144ca", "value": "12:q0F2ZkNPRFKX0F2wkB7RFKX0F2oiko4fRFKX0F2RktRFKX0F2QLkQ2hVDRFKX0F0:vxUDtUqJYht7qweSVVdkNkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764748025, "uuid": "ab8c8ea7-f55f-43f7-a7f8-35b46b40fc1f", "value": 2672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764748025, "uuid": "01deff03-3b3f-485e-97f1-d4a4ebaaa0cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764748025, "uuid": "16847cb6-0392-4134-b021-67e5f2659732", "value": "lg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9e5c53-d091-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764798587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798587, "uuid": "0d851e4b-506e-425e-a8fe-09373b10c90c", "comment": "Malware payload", "value": "9a80a079268d54d256104cf43506b64e", "object_relation": "md5", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798587, "uuid": "3bcf1a16-0843-4246-9102-3b364cd40c58", "comment": "Malware payload", "value": "e0ca821e2879953b7a5bb05f826987c5d23829020947c0354d74319f32b6f62d", "object_relation": "sha256", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798587, "uuid": "cc0bb4c3-daeb-4303-ad8f-2c6a34567862", "comment": "Malware payload", "value": "6aae86a006cd8afdc81cceef9393101a39ddc3fd", "object_relation": "sha1", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798587, "uuid": "dce73cc2-ac4b-4c8e-81a5-e469c0daea76", "comment": "Malware payload", "value": "873250cb3deb08e4fae562d0a9674e3e7f7cce080ba2ce3b81f79190f74def7c3d12ba6373b3d5d24376067a58fe61c2", "object_relation": "sha3-384", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798587, "uuid": "ee4ec9b3-ebb8-4c56-9b46-3a08e86f661d", "value": "T1A641843C278E8452F32A977CAD91687338BCAF1F7768B68B701C91684D79A00479D0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798587, "uuid": "d65240d9-2f02-4637-a766-bdd2d3ba31d3", "value": "24:9e6zsMyDzwe8us29+UMApScDjiGiMWn1bXxk4FYiEKGFH56XhY0HUsFEc1HG0icZ:9ezD8DYApcDjir5XxvFzJUs7akoXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798587, "uuid": "70764ee4-96d0-447d-922f-acc2415ed936", "value": 2272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798587, "uuid": "23db7971-5ca0-44ac-8d85-189e82a58596", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798587, "uuid": "2f1382ff-b524-494f-adb6-d5f056c4bd59", "value": "Shriek-Agent-2.1.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec1ccb1-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764767855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767855, "uuid": "dba364a5-1659-4ceb-bc01-486eaef53c1a", "comment": "Malware payload (Stealc)", "value": "4ba9689d8ad0415fc69153ac434022b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767855, "uuid": "841a6aca-251f-48d3-9fd0-8bb5293dc2a3", "comment": "Malware payload (Stealc)", "value": "e13eab84b5d51db02ab19e24a6c7732642ee815ab9df3f0708bbbede257d8ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767855, "uuid": "57d92c73-808b-474f-84f5-8c96903ff84e", "comment": "Malware payload (Stealc)", "value": "ee85a34f8ab31a0749e6819cc42436ae460cb936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767855, "uuid": "6cada294-2f0e-4170-9148-924c52bf1826", "comment": "Malware payload (Stealc)", "value": "6c76aadc5719bc987fa9e1e44277ae6bf27acc67ff7db017a68763efb2d5b0d53dcc943101e9bf5c28b6388f0db48735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767855, "uuid": "8adb0b5d-65c1-4031-8dde-a96290eb29bb", "value": "T1C1251223FF53B9EAD9E505B18C2600F326126C175B501F77A2B4B22A0CD566E3E37936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767855, "uuid": "9d9ab798-6565-4ed6-9107-e3307d89bbc2", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767855, "uuid": "4ba38d10-0775-4b33-af92-2df991e31973", "value": "24576:S9OeNlf/DoUrJ2aAcrx6LRpIa/VuOoElo8xw:S9OSlf/DoUrwXn/IrOoElo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767855, "uuid": "de304e0c-39fa-4f8a-9020-4b2a7e89b5b9", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767855, "uuid": "874b87be-7a60-4b0b-86df-30c7b6b59da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767855, "uuid": "47439709-0f44-47e7-acf6-9df0b956377f", "value": "saylen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddb864d-d062-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764778242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778242, "uuid": "a8232267-69f5-47c1-86ad-9e2609317444", "comment": "Malware payload (SalatStealer)", "value": "3cdf61953f81c5cf1a36505edf435f74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778242, "uuid": "f0e25dc7-1008-45f5-a29a-2842f6c326c9", "comment": "Malware payload (SalatStealer)", "value": "e1b28c54dcd0bb61b29c986b2f893977060af99d1bb732fb1bd636ac90d3839f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778242, "uuid": "fd6e563c-33ed-446d-bd75-782648854262", "comment": "Malware payload (SalatStealer)", "value": "d81ce0f57e888349e28b0b99e1af9bf9fbef0946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778242, "uuid": "12e48972-f341-45a1-aac0-89b392c645e3", "comment": "Malware payload (SalatStealer)", "value": "0d9b7719791b58c60676d15e00b03b46ae5b60ad7ba751d6d1d914a521e15dd177ccf190b07b60d812b08686aa5a5034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778242, "uuid": "c20fd1aa-f638-4c30-bb51-3728998346c8", "value": "T17BC65B51FA8B54F6E9031831819BB23F23315E048B28DBDBFB547B6EFC776811866249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778242, "uuid": "0391be01-29b6-4fa4-be1f-b4aec863a224", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778242, "uuid": "9a8ba082-0d2b-434b-ae17-9269585d16bd", "value": "49152:X7HJrlkp3obzfY614G7e6zrzvaE8ZciFifVbeja9FemraUGNmzjTq5uF+mUziqRV:rpriBC4DrbUI3RzdkFkty0Dvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764778242, "uuid": "a81f1e38-a774-4e99-94ed-9cd6df3b44f5", "value": 11659264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764778242, "uuid": "cb9d05e5-19eb-4977-89aa-9ea2088158a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778242, "uuid": "16517154-f5a7-4de9-8ee1-c95a850e3845", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d0716c-d06a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764781443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781443, "uuid": "55778e55-69a2-4695-95f5-efc035c658f5", "comment": "Malware payload", "value": "d5fafc08c97a9b5758327f04712d7a36", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781443, "uuid": "e901e909-d96e-45aa-8c3e-d8b434f9ecfc", "comment": "Malware payload", "value": "e1ccb50de3b2ec0d6ed82f4ce2980702b130c2d31ebfaa52a56cc0d6667f4cae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781443, "uuid": "192336c8-4959-4f98-977b-d163c6d89da5", "comment": "Malware payload", "value": "060cb52245297ec5bbf1c1b3acecb401807a2db1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764781443, "uuid": "b8ef8a98-3453-4dc1-9e10-3c1c83166436", "comment": "Malware payload", "value": "ee3bf1b61a1012dcc0f3d4ea7fbb004d4bfb157fd35b30883da70a3fb5ef9ccd7973f7a5450100eaa568e9a54674adf3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781443, "uuid": "2598eb5f-9aca-47f1-bc0f-0a6dc4001263", "value": "T14A4533B0F061CE1B2DF45D50BA5611BE2B0B72787B75DE223E815D9640E094C2BE5BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781443, "uuid": "85944fee-1883-40ba-b26a-a5bc7c290377", "value": "24576:Z/yAPI62wLfveG2VrgFSitFBz8xRI0IbpDp6jeGJsrpWOMrhs2BcRh:Zy4VGz813si9pweMsrnMrT0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764781443, "uuid": "45997536-b83e-4aba-8f25-73a555a6c917", "value": 1178404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764781443, "uuid": "b7fc0451-b5c5-4809-9ac0-e1b7b5707792", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764781443, "uuid": "35c1700b-9058-4e68-86ae-72880ccad6a3", "value": "Expediente del proceso ordinario nro.585745814.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc90253-d00c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764741090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741090, "uuid": "13c9a1a6-2d9b-4a4d-834c-66b0e2de5a75", "comment": "Malware payload (Mirai)", "value": "b4b5839244e4be25a6d98fd5fcfebdcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741090, "uuid": "d9146a8f-9725-4c41-a42e-adacc783d3ff", "comment": "Malware payload (Mirai)", "value": "e1deb00dae918414d229b0549f94b186f362f28036ecccc18ea5422afaea95e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741090, "uuid": "2d62835f-1069-418b-a174-068da8199f62", "comment": "Malware payload (Mirai)", "value": "d582dee1c5451e8fc527ee0a56730e2c5e791426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764741090, "uuid": "3c6fae00-bd72-46b7-9004-14a830d48faf", "comment": "Malware payload (Mirai)", "value": "dab17b75d1a83ed3ab9448f63cf2c2878e6a357baa7a2c4888f7870abc8258d129b3ff0daa236fc1e5e9f34f0dc6b07a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741090, "uuid": "2b164e8c-205a-40f1-a728-e83290fb7c6b", "value": "T113C30945FC905B12CAC221B7FB4E428D772A5768D3EE720399256F24378B96B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741090, "uuid": "45d701cf-3d96-4a42-8788-467183995e12", "value": "1536:OCRYb5R+KaJW0M2iPc4VeEthTJoMnJ+OelS1IFfjXlQWwywN1Wrwg20g/BQ4JmQy:Oppak0MA4rbdoMnJ+qIBnMPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764741090, "uuid": "68face9c-56f3-403a-a184-e2fcae9d8c95", "value": 125536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764741090, "uuid": "6f93adfc-8e1d-4525-a76d-e46177f3f002", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764741090, "uuid": "435d25dc-d960-4583-8424-9a521392bb5d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbde4504-d00b-11f0-a129-42010a9c0007", "comment": "Malware payload (Hailbot)", "timestamp": 1764740953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740953, "uuid": "e2ee199a-ca87-45c1-8fc9-3bc49dbd1b78", "comment": "Malware payload (Hailbot)", "value": "c6497867c5e4280fc1debb789a0ba10f", "object_relation": "md5", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740953, "uuid": "0876bec0-4c84-42ba-9ea7-416847850103", "comment": "Malware payload (Hailbot)", "value": "e2a4ed692a935b2839d42806236c9e788596e3f357228557a20299fe89c60332", "object_relation": "sha256", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740953, "uuid": "df3afc45-6700-4917-b839-b441c7710055", "comment": "Malware payload (Hailbot)", "value": "6b6e704fc142668680fe31c05f1674c9a29ca878", "object_relation": "sha1", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764740953, "uuid": "c633fabb-d667-4088-b7f3-c91b8e061ba1", "comment": "Malware payload (Hailbot)", "value": "438b42661ad1bbe3d01a83a63bba43397a9f5f4a5f62088b6d342b4f7ba05770af0ec37870d390bfe11b5ff4a36960dc", "object_relation": "sha3-384", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740953, "uuid": "f832cca8-79b5-46e8-9f01-6d4682ddc895", "value": "T1BDD05EA524A2142ACD48CFAB937714E3354AA492A81072CA3267C256AE6C7A16B4A588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740953, "uuid": "7db6cc47-44c8-43a7-97c6-41fb3cfd2620", "value": "6:hx6eGrl49KGKwz8JnoafaI9uN5tKKuNYRGXBV:nP9MJoaCEuN5tRuNYRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764740953, "uuid": "5c9f0e23-7651-4f01-a34a-791e356446e0", "value": 245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764740953, "uuid": "bbdfac45-ff16-418f-9f75-a50de16531ae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764740953, "uuid": "1e4d8893-9cfa-44b9-a1da-242b886dc0f2", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6189f39-d06b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764782175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782175, "uuid": "53adbaeb-f671-48c1-bba3-ef04afc1b3b1", "comment": "Malware payload", "value": "e62ad6f163a5f9e18c9ed89f2205078c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782175, "uuid": "3d766ab1-f66f-45dd-82d6-e276975c9319", "comment": "Malware payload", "value": "e336787bf1176d82bc34b92e2f782f568d2f7c21aa26db0b29d062c91a0498cb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782175, "uuid": "307857b9-8378-4052-b839-2ec24ee310f7", "comment": "Malware payload", "value": "95af15f3e28837df4b598e32750dd899edfe0512", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764782175, "uuid": "5510c418-f682-40c4-842e-af348d412ca7", "comment": "Malware payload", "value": "6dfc74c98bd50d864914f67051342e6663bf691404a42b86b94b9b19bfe5da7c10ea7512645caf52dd8a3516fdbef70f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782175, "uuid": "ed2a3a1a-5487-4710-adf6-35c6f97da7aa", "value": "T16357234EF358A92EF437513784BB1232D5570D52AA42D3E37929B30C29BB9D44F1ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782175, "uuid": "baffcfe5-b4ef-4406-9c8f-10eaffeadcce", "value": "786432:8Nx8NOHPXe7HLl9TrSC5JOOI/iQmgy8CFoLMJ3XsoJzAi4Wq:6x48MPTRd6iszCFoLM9f4Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764782175, "uuid": "7dbedb56-baee-494a-8b85-d5df3a17ee1f", "value": 29659091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764782175, "uuid": "66e51717-86b4-4243-a3d5-11ac268da677", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764782175, "uuid": "02803879-03be-4e64-9475-e1ead0ef949a", "value": "kalyanmatkavip.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ac2519-d005-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764738157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738157, "uuid": "35dbefdc-7837-4ff7-b3f2-bbab767b58f9", "comment": "Malware payload (Mirai)", "value": "2b194e8179e936e910f0cac1c59e2615", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738157, "uuid": "0438dbfd-996f-41b5-ba4d-8f798f4d568c", "comment": "Malware payload (Mirai)", "value": "e3857637ddd0138f18dd96e81af43cbd6ca7d786764d43d341a666a878f6c561", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738157, "uuid": "73750828-8d6c-47df-b6ae-22f5d32b38db", "comment": "Malware payload (Mirai)", "value": "8b26cab74728edf6d8f8bda78afa8f59f277ccf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764738157, "uuid": "016aa137-2115-4690-baa9-401538f2354f", "comment": "Malware payload (Mirai)", "value": "ba39bf9420dc0a6e2bc981646911d35dcdadf3c0ef291f74ef1e1d1a83a5d795634e6230bf71391dc5c033a4b52a9f6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738157, "uuid": "8f9e584e-6602-414f-839a-c2be454f2bc4", "value": "T1FAB2E071045B38B3C2B0093BE8E4C6B5252B8BB0D2EA72963240C6CC55DE913F5F96D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738157, "uuid": "b6595f7a-056f-4953-9c27-fa7205c76cd7", "value": "768:eoB7q9/ThcrT66e4/fI43bqV0nLs3UozBu:JB7TqiXj3MVzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764738157, "uuid": "4431ea6c-2b07-4ace-acd6-246306f9261e", "value": 25300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764738157, "uuid": "48609a97-cbf5-4472-a401-914f4ff873c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764738157, "uuid": "09498ffe-7bab-46d0-b272-e70156998888", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28a46e9-d04f-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764770143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770143, "uuid": "6fa97144-05e1-4cd2-be4f-9dae1d888612", "comment": "Malware payload (AgentTesla)", "value": "ae923718718106af1805275b712f998c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770143, "uuid": "b5ca099d-f7a2-4222-b46e-ad0c9baa8849", "comment": "Malware payload (AgentTesla)", "value": "e42facfa650f7b6fb31f2cc187f623993d316701e3d20188d9eb260c2f14511b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770143, "uuid": "6a3e7371-1431-4e2d-a341-b00e021ac497", "comment": "Malware payload (AgentTesla)", "value": "ecfb7d8eace1d24198fcdd814536a8d9fd424334", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770143, "uuid": "547c7a28-ae6c-44cd-9a5d-81a9aa1d163b", "comment": "Malware payload (AgentTesla)", "value": "53de6ffc8c1368ff63a93ec4eea4b6dd15a24ef110998b09667b7d91f3184e8abaa16e3ba89ed23f26b1202ebcb6e023", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770143, "uuid": "8332db10-d686-496d-9c0a-b41e5524e8b4", "value": "T10331CB047ADE4730E3768B376CF6E3028922BC51ACB34A5D50848F8D3863600EC65F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770143, "uuid": "b665e565-1a89-451c-8493-0050815e64e8", "value": "24:81J/ByUz8WMleYTxDAiHBRJCFfzb4AB64RFL4I0apgAlVu1ddzS/UtLFhwiXQ6cb:8rLMgmUiHJQbNLuIA31V1XCi3WzFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770143, "uuid": "c3304690-e9bd-4fb4-a77f-7369d31988bd", "value": 1863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770143, "uuid": "8d0ce420-2220-4a0b-b963-7299dcac2598", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770143, "uuid": "6d8e2326-4287-4ce3-a8e1-de4333d85482", "value": "RankupServicecleanerV6.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b1a2a7-d03c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764761661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761661, "uuid": "2eed806d-d9dc-411d-806b-83c6fa9a7ec3", "comment": "Malware payload", "value": "fb328a8caa3fa8473624d70b6842c77e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761661, "uuid": "721b2fb1-0423-4c1c-868b-dacd011ce08a", "comment": "Malware payload", "value": "e493fb5dd552583243a53616c5d145f3e0e560b983e3eec034b546b066bba85c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761661, "uuid": "87acfcff-88af-4a44-bae9-9d16305169bf", "comment": "Malware payload", "value": "2a5ddf59fc2b1fc42f79024c231f16c77c4612b4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761661, "uuid": "73e824d8-96c1-488b-b67e-177ae884fadd", "comment": "Malware payload", "value": "5081b87851e7ba0dbf5fca1cf414eeed099b5196db21b4feafc4aa42e73af28a40b920f8f78a099bc5285c8d5354e8b8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761661, "uuid": "3a5c6e29-96d8-4c38-b23f-3fa707322c83", "value": "T1E006336AEF149032D73BE6B2ABEE4BDBD3974BB892A1D40E4002D15D78115F148EE4F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761661, "uuid": "014c2bee-a009-441c-9605-acbd0fdd301e", "value": "98304:7Cg0ONP2plHOECnY+Ahh8yA+1i4EtJUMNIK8C5bw5EET:7Cg0O8luY1bAh4Etvd1yB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764761661, "uuid": "aabf7097-5fa1-4977-b6d1-3a80b89261cc", "value": 3912494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764761661, "uuid": "b1999760-ed2b-48c0-aba5-46340c0bad6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761661, "uuid": "76c1f37a-09f4-4040-8e2d-c3db1e7ab843", "value": "e4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dfe1a3-d079-11f0-a129-42010a9c0007", "comment": "Malware payload (Neshta)", "timestamp": 1764788241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788241, "uuid": "38dd2c8d-6519-44ae-b52a-3760032b9f58", "comment": "Malware payload (Neshta)", "value": "5b72b65a02cb09f3b6bee414edb1607d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788241, "uuid": "8dcfa273-924f-4b8a-beb5-9e1d2859fbe7", "comment": "Malware payload (Neshta)", "value": "e4c6311e88083ab971d7d8d3c622221eadb86564654b8f20cc0e8159d61054d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788241, "uuid": "8165c05e-198f-4915-800c-5df89807af1c", "comment": "Malware payload (Neshta)", "value": "d62d903066104a57cb7e8d5bc32e7981b8148b7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788241, "uuid": "e85f194a-f21b-4fc0-bfe5-bc31730ce3c9", "comment": "Malware payload (Neshta)", "value": "c48e342b3f8a785417469721fdef6a10b885c062f1af09f7168f3bff2d86f1f402e7bbc670438c0242764a5c0604fe52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788241, "uuid": "4ebf4aeb-de1d-44fd-b52b-3f0295cb5b03", "value": "T109545B02F2AC7CFDE0668534897185A2AB31FC312750969F53F57B552E322D3BD2AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788241, "uuid": "84032bce-7773-4c8d-a902-bc7680e247db", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788241, "uuid": "2b973ed2-ba2f-4402-b44b-4946e2c3641a", "value": "3072:sr85CCmbIDLci6jf+0aF7HqKxgCgGnqxO1BwMpdCq/IM8uIGfy/m36vZll7o+er/:k9CmbI4b+0aR3Z1BwMd7wvc2AHrvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788241, "uuid": "9c26ef8d-027b-46ca-930f-11a60bf87a97", "value": 293208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788241, "uuid": "30209b29-568d-4c53-9692-13a83f7b7e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788241, "uuid": "c01b6033-e4c0-4669-a89a-e88971c86cdb", "value": "venvwlauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50655731-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764770381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770381, "uuid": "81284f0a-602c-4895-9ab4-ba38c824bf5c", "comment": "Malware payload (RemcosRAT)", "value": "313b7c0c5da2199ead7fa843b2f55819", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770381, "uuid": "a02f62f4-2020-4a96-9804-052f3f359b4e", "comment": "Malware payload (RemcosRAT)", "value": "e581a47768d45ca9998f019347ed8171410e806c7237cd2a109f5934fbac680f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770381, "uuid": "6b5ab867-6957-4b94-9b39-90e9a6a01c9c", "comment": "Malware payload (RemcosRAT)", "value": "f059ad6e0023e0194c66d14424f63b1a23fb998c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770381, "uuid": "85628416-db66-45b2-8c6b-50d4a05d49b8", "comment": "Malware payload (RemcosRAT)", "value": "222987a9418a50f6eeff31125eb3ba186379e3a328d855597cf472f0b81f7485f3667002946e3163b22d325c32283832", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770381, "uuid": "d53bc3f8-19b0-4328-b1eb-ad44b52dd6a0", "value": "T151F1FA42DDA73A3AF215820A80D603967E78CFDB480160FF3956967B65E6D1C031F327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770381, "uuid": "e428baa5-52c9-4392-9073-8a2a833887ec", "value": "96:ObazPRLuznqg2QT/ZWmIeStEFEnrheR/Q87+n1sXSwVZMzmrv0CI+WY/IjzW:OOLIqiwmjSbnNeR4k+n29VZMKbtwzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770381, "uuid": "9f2cd2be-b9db-480d-81af-6839fcdea2fc", "value": 7669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770381, "uuid": "3a8e958d-5f44-44e6-8bd7-377f39705d37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770381, "uuid": "f8a9aad6-e24f-490e-8da3-44b80b76f1bc", "value": "ZF CVS Turkey_docx.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4309a653-d004-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764737717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737717, "uuid": "446f72fa-3f0b-4f7a-9b32-259dfb5ced53", "comment": "Malware payload (Mirai)", "value": "33b34589b45bfa0d40e6f3b1afe48559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737717, "uuid": "471e84b2-ad45-46c7-8285-23775ad355f4", "comment": "Malware payload (Mirai)", "value": "e705af01971761db5668e324d9d291f55559bdc461f54413e873b29429f16027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737717, "uuid": "700416f3-93b1-4683-a845-3df2e425baef", "comment": "Malware payload (Mirai)", "value": "4c6c62c8da3c2d311b30c9ce0c25619c5f43b732", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764737717, "uuid": "d1cbff70-f504-4800-b878-e7fb0888f5d8", "comment": "Malware payload (Mirai)", "value": "ae8deb4427da5eec9f09f7253864d727ec14bcaba2fa01f9892971a56fda20f5727e96ff1c10185dc633ad7b846bede9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737717, "uuid": "712eb032-7852-434e-81bc-e6cbac22951d", "value": "T11DB3121530DBC928CA196E3E1296FC59EF91FDBB582ED7153A386861E2257D1B8C083C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737717, "uuid": "baa2c6f2-4acd-4ddb-a0f3-ef7113a0f7a8", "value": "3072:tF7hIvLVg76ijJ5hZtkpgyC440nsIkX+TZhuAZtGwVK3e6soHN:LhP1JrZ+vpsGVTtVM8ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764737717, "uuid": "3a187e24-f113-4a7a-8564-c09f52b3e27f", "value": 117072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764737717, "uuid": "6fe4ad62-851e-496d-b32c-1c9329841121", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764737717, "uuid": "bf7661b5-ea70-4248-8fa0-3b2436e6d408", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad5ba52-d03f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763043, "uuid": "e4259602-709f-4d48-8502-b2ba7fdfdae9", "comment": "Malware payload (Mirai)", "value": "b397e8e5e360eeff877b54fa096652b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763043, "uuid": "f9094bfa-f3dc-4513-9b4d-518356c1240e", "comment": "Malware payload (Mirai)", "value": "e72aec74ea6e95432b70e7e0987c90c0c7ef1e469a96e67180a7a6d0befa7f0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763043, "uuid": "85707f4f-e619-4f76-ada7-ea72bca3361a", "comment": "Malware payload (Mirai)", "value": "a610a3519a51f3b8c9eee3db919bf853e1a4a135", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763043, "uuid": "3bab8119-bd71-4384-b862-2505e3262e31", "comment": "Malware payload (Mirai)", "value": "f56bb9a4052f4d43c5531bec64e26a338d7b6100c292bf4994f44cd32ef8af669ae93b91a7503948ca84d66b4cc8a864", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763043, "uuid": "6f982a02-86e2-4602-9c36-009bbdbb64e2", "value": "T1C5F3F80AEF710FF7EC9FCD3705A91706259C581622A82F727634D868F64B28F25D3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763043, "uuid": "39c378bf-8d82-426f-bdfd-9fdda13f27f5", "value": "3072:Qwqolg1R7g9cA6NL7lmOLeu2/ateZQUUOT3:Soq1R64NfLeZQgT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763043, "uuid": "f5452a80-8ece-469f-9ed9-fbf78b6dc13f", "value": 159280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763043, "uuid": "4cca0b83-c4ee-4c40-a765-be17fa59ef36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763043, "uuid": "a1355b88-382a-4e32-a33f-2d9ead1e3452", "value": "SecuriteInfo.com.Linux.Siggen.9999.11068.8131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cadea04-d03f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764763019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763019, "uuid": "56206df2-272d-492c-a86d-a8497531648c", "comment": "Malware payload (Mirai)", "value": "733d3cec8bd2d93fd9456dac8e73945c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763019, "uuid": "527ca3b3-b098-4c7b-941c-b672c44aacb5", "comment": "Malware payload (Mirai)", "value": "e7fdc56e9b880a026a1edac02e84a87d4164b5a425fceac310a9582f0b899895", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763019, "uuid": "80fff146-b5d8-4465-9885-2912355dd9a4", "comment": "Malware payload (Mirai)", "value": "9ae63542aa5d7f34bb5ac4b51492a29747bbe1d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764763019, "uuid": "759eaf33-ff62-4538-a965-694b29686e4c", "comment": "Malware payload (Mirai)", "value": "5576205b8a06f06e3f7046dddf7a83e5e9565184238c4d3e2abc1227882ca42086c0d0813e3f4f186ac0656acefca692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763019, "uuid": "cfb4a43a-f003-447f-982e-b973dd302a13", "value": "T1A623E15AE17B0A99EF1C8C30114853745E89AA91378ACBBCC714EDDED70E4CF92698B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763019, "uuid": "a0b31084-2ab5-4dd2-a417-844a8bc6603b", "value": "768:YVRAagrFZ6rmetys0bHSbvhsrL4ajCWqbSS52TFvebOCshcIiHhhp3EDVQLa/WMn:KoFMxtys0mLmPNFqbVMTT+x3EKLan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764763019, "uuid": "6f493dc1-3a33-4792-92cb-9fc3776ed594", "value": 47400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764763019, "uuid": "9147690f-5e63-427b-acf2-4822118541d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764763019, "uuid": "c2693c6d-efc7-4121-bc29-6e014ab155d7", "value": "SecuriteInfo.com.Linux.Siggen.9999.11068.8131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56929c51-d07e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764790148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790148, "uuid": "6467eca7-c241-45c1-acba-96aea14a472e", "comment": "Malware payload", "value": "4870e74cddc7576143e8c5910418accd", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790148, "uuid": "d5f6334a-becf-468e-ad1d-726826e5b210", "comment": "Malware payload", "value": "e90e2fa178f7ddaef4dc66913ea2157b13f1c246e0753229d05c094973814590", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790148, "uuid": "defbf1ba-012a-44e0-a4c1-3b7609bc5d4a", "comment": "Malware payload", "value": "7ba5639fe24ab174c3725422eb40d0426dd77247", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790148, "uuid": "5acee3b8-6444-4e47-9654-121822c69175", "comment": "Malware payload", "value": "b802f828e6f77c900fa7dde2919914e37e5dde9ff6ccafbaac3c59df0f579e5b409b48d67a3ea45b61a3874efd43cec2", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790148, "uuid": "774bcb90-50ce-4253-8e26-f3f0c1284f2f", "value": "T1EA051202F541DB62EB490B368F53D3E6236DFDAAAF2E46037641731F29322D3B942546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790148, "uuid": "0fe10427-4ff1-40b6-9193-9e07e2fb5cab", "value": "24576:Ng00g7NEebMjtDoVHvhdZIAI5dzYwMDqSf:G00kiDolhHK+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790148, "uuid": "f7d183bb-fbed-48a0-a1a7-9d6f856b1d6c", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790148, "uuid": "5cff6697-878c-4d6f-a4e5-d1d3dffbef70", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790148, "uuid": "62156931-562f-4425-afed-264e059e63a0", "value": "PO P3345369189401.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323dcfe5-d023-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764751003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751003, "uuid": "6ad5dd78-7743-48fe-b09b-08da3d79bc50", "comment": "Malware payload (QuasarRAT)", "value": "25f1c71e8045425c2c9b3d3947847cba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751003, "uuid": "86a96a27-3ffc-4f8c-aa7c-df6effab316d", "comment": "Malware payload (QuasarRAT)", "value": "e9a2e9ce85efba103622a6abf25c4e0d280eb5ca8012e43db46b5394b8a1db10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751003, "uuid": "c277438c-c73b-422b-b89d-b88df575c4fe", "comment": "Malware payload (QuasarRAT)", "value": "37d1e5080c9443eb80fe8ba5e2b489e644b016a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764751003, "uuid": "7f1b917f-76c7-484f-9886-0520716e7356", "comment": "Malware payload (QuasarRAT)", "value": "591a2cedf0983bd75aa472c6e04ea3e773fa4ca79a3cb73f398eca6adfead8feefc4737f20fea1160ff695f4974d0914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751003, "uuid": "0d4a9aaa-f465-4be8-9f8f-5cbfdcfe0600", "value": "T1F6F523EE7594A4EFCA03C1798D649C3852626DBB5723C20314273CE7363D2DA9F294B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751003, "uuid": "fa94c9b7-de2b-45f7-be03-5c5b1dbb3db6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751003, "uuid": "c917f42d-b593-4c67-9322-cc50c169a496", "value": "98304:hnsASxm2CdeRvN7i4lVX13zagNZa6qnWSu57NYa3:NrS82YeR17hlVFeSunWSuEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764751003, "uuid": "4a83df0e-e8a3-4b43-ae88-444b1284e4e0", "value": 3399168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764751003, "uuid": "77095295-48f6-42ad-a84d-ce7a754b8917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764751003, "uuid": "0eda8db4-8d42-4b36-b239-5a9611c2ac6e", "value": "Comprobante.transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971b01ab-d027-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1764752890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752890, "uuid": "1dceb492-12b0-4ef2-9691-fb32d9f03e02", "comment": "Malware payload (N-able)", "value": "25d2280a8a32e5f947bddaec33ec9368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752890, "uuid": "31dc7b0d-69df-4f18-829d-814448874ad1", "comment": "Malware payload (N-able)", "value": "e9c3818e5db04e727177ecb290b1d20022fd7301339e8be69cf15292a9cf7983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752890, "uuid": "95f44afb-5930-4574-9268-0cdfe22c44c3", "comment": "Malware payload (N-able)", "value": "c87963c2f73057fc9ffcce6599868b8692936d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752890, "uuid": "ad7d46fb-a50c-479e-bb10-acb766150b46", "comment": "Malware payload (N-able)", "value": "c000150bd762d3e26828db62227ae5223f42cfcd62c844d2011d4296cc9cc3c065e90758dccfdba5a92ff822bf60a7a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752890, "uuid": "1136b1d1-40e8-49c6-b5b9-ce2b4e0f3e5b", "value": "T127E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752890, "uuid": "1926fd8e-9a8b-454d-8c0a-4c83027ded9b", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752890, "uuid": "dc98ef83-e1a2-489b-82aa-4cf73de6fab1", "value": "393216:V2F/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1X:MrRxvoC/7a0jUxX7h1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764752890, "uuid": "10d8bdec-8495-42dd-8e0b-9303c08ee469", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764752890, "uuid": "3c54cc2d-0de4-476b-b200-83adf7b6947c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752890, "uuid": "9e58c6a3-1693-400c-8dd6-bbb5a191e822", "value": "CitrixReceiver_4.14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165ad215-d070-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764784027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784027, "uuid": "05b5f6f8-4906-45fb-b913-bced7c653f3c", "comment": "Malware payload", "value": "b420e3e7a16d1fbe9a612bd77260d418", "object_relation": "md5", "Tag": [ { "name": "151-243-109-125", "colour": "#E68FCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784027, "uuid": "111170f2-71dc-4c3a-a22c-d524f9b71b1c", "comment": "Malware payload", "value": "e9d7f9258da370accb309bfda3fea6ab4691aa95030f6edbb1e53a3c93047dd0", "object_relation": "sha256", "Tag": [ { "name": "151-243-109-125", "colour": "#E68FCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784027, "uuid": "34bf0182-6899-4d77-832d-1d46df42da0c", "comment": "Malware payload", "value": "e77d7334a75f5a40a1267217b81640ca4cacceaa", "object_relation": "sha1", "Tag": [ { "name": "151-243-109-125", "colour": "#E68FCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784027, "uuid": "e1ef7f03-ca1a-4275-ab94-5804d6a92600", "comment": "Malware payload", "value": "ff358f521871e27a77f8ac44719d1bfab2cf75912b80e49cf5b30b53b7891c8daee9b0a68bf051ae715b36556f0b0145", "object_relation": "sha3-384", "Tag": [ { "name": "151-243-109-125", "colour": "#E68FCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784027, "uuid": "38fee724-5dd0-40a1-b338-099dfed684db", "value": "T137D733CDA2920497ECC5413692C4C578CA95A80EDFD9938F5FF80A416E639E8CE7FB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784027, "uuid": "d34dff93-8c5a-4361-a412-03b6141de48d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784027, "uuid": "487739c0-e392-488a-8d75-3258ae9f81f1", "value": "1572864:vEWkWPiIorZAVPiXq41IRXl4Hzdf4kWz93ApgaKpc0y:vEWkGaiVia4Gl4mJh3Aqvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784027, "uuid": "c4135e2f-1e46-4b76-b9e9-e2dbed16c4c0", "value": 59777264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784027, "uuid": "6eac0641-586b-4b02-83d2-e1754df9d8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784027, "uuid": "66c23659-88bd-4466-b1d0-fadf93fb73c2", "value": "LON-setup-x64-3.7.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb01deb9-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793833, "uuid": "327e2caa-4a84-4adb-bee6-55df3c6417a9", "comment": "Malware payload (Mirai)", "value": "3f3060678e4e336e78f349ea4b02c77e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793833, "uuid": "634f5c11-07ce-4704-b32a-9070a078b6a9", "comment": "Malware payload (Mirai)", "value": "ea63756a1fb1baa794e9b1314bdcbb98b964320a0417371fae3ab16722d13ac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793833, "uuid": "0e31e4c9-9274-4005-9207-5e0b94beee38", "comment": "Malware payload (Mirai)", "value": "9a910445f1abd439de731da43483980ba09fe34c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793833, "uuid": "ef0236b1-06ed-4217-8eb1-bd96f20c900c", "comment": "Malware payload (Mirai)", "value": "2d4721f74cb9448fd0cd44cc486115249f95afaeaab5bc629ba01b110e8f7e5a6f28020f9968c8b07e7f5d908c7581df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793833, "uuid": "cfbf8dcb-ea80-4e44-9faa-53c7878b5051", "value": "T153A33A46F9818A21C5D512BEFA1E318E33135778E2DE33229E14AF2177865EB0E7B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793833, "uuid": "d35fff3a-f7dd-4430-9c35-1b04f4a4a148", "value": "1536:sAnwQOfQkBWAn5oJ0ayXbCpqGBDKQxbA9sC71aTHDqXODKRiAkPxKp9A7AH5JYWu:IQJMwpqkm6C71aT4kPxKpeEH3Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793833, "uuid": "9b3d5ca5-50c0-44a8-8908-3489ee9f4936", "value": 103900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793833, "uuid": "0136221f-8656-488b-a3d0-aa0775c37ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793833, "uuid": "e67ae843-a9e5-4d6f-80ac-524d0ee6f34a", "value": "zerobotv9.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb90234-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793836, "uuid": "8a28972e-ce67-448e-b482-75458e8c3923", "comment": "Malware payload (Mirai)", "value": "80a033472e3a5c40b86acfab028575d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793836, "uuid": "59ef9284-52f1-43b5-ba48-c87a4dd5da71", "comment": "Malware payload (Mirai)", "value": "eaaaaf6eb4a0df0dec27ba9bef52b625665fc24207edf5a3ff04cfb8068e1b1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793836, "uuid": "483f67fd-2cb2-4e4f-8695-fe521bd2a49d", "comment": "Malware payload (Mirai)", "value": "843f8427479a301524b1db3599209e8b82b4b911", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793836, "uuid": "0b2340e7-97ca-4c43-a8dd-53a2fd4ef131", "comment": "Malware payload (Mirai)", "value": "0472c60778681a0b04be7fcc13245654ca13e2f95df2c61817efd4b540ec7d08ca207546585fda0cbfd53c9e8b4ae790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793836, "uuid": "dd7a956c-c9dd-490e-a38c-3fee6b3ad272", "value": "T1C8C3E709AF610EFBE86FCD370AA9274224CD551626B87F3A7634D818F54B28F15D3A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793836, "uuid": "cc563d47-68ae-47b8-8237-393dcae4afa3", "value": "1536:pu4m4yPqsV/EdTCBGs5S7ze2c9cRfn9u/07voB+YkZSEga6+fAEvMJojTMsQ:oNN/EdTCBGs5/c7voB+YkAdloj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793836, "uuid": "b825bc0b-55d5-4f15-9f41-2e224682392f", "value": 124784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793836, "uuid": "8b7364cc-2529-4ff3-8791-e2cc1c3f877d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793836, "uuid": "68fe3ce0-d35c-41b8-892d-9ddcc6a30fe6", "value": "zerobotv9.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f2143d-d016-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764745642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745642, "uuid": "38b1fcbd-aa22-419e-8431-c93ae6293ad4", "comment": "Malware payload (AsyncRAT)", "value": "5bbae0b2dbc254dac09e286da36ada10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745642, "uuid": "96687bc1-3bea-40d9-8583-a13880590e9b", "comment": "Malware payload (AsyncRAT)", "value": "eb471c9fa93384179f04afac5292de5da31695098c94c440e7144b17539a5c79", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745642, "uuid": "a8e57388-20fd-4632-adf0-a96674425ab5", "comment": "Malware payload (AsyncRAT)", "value": "927a3257a8e4faa9b1b1b24757514b312d3a6f03", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745642, "uuid": "73b04cac-5f58-476c-b627-908519fc491c", "comment": "Malware payload (AsyncRAT)", "value": "36e985404df0447e8a0681e1f586ab7242c841ac9eaf1d06b03dc9f9381f55688f59bf796e954fb13241333f7c9aa7af", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xword3-duckdns-org", "colour": "#BF6A92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745642, "uuid": "fa649dcf-8606-40f8-96c5-bbe58400aed9", "value": "T1EFE39D00B0D1A431F5B7093645F48DA99B3DFA301BD1AEDBBFC809AA8F305D0653596B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745642, "uuid": "5159f40a-7c0e-4c54-911c-021a83c4f9fb", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745642, "uuid": "0d7364be-619d-486a-948e-2e66e4e2d467", "value": "3072:d3AlCua6Ty3XctCkh3jBzBueU9audXzWcXaw3aRHTkw2fIgg9/NNQk:6lHWct/jKdXf3aRHTxPn/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745642, "uuid": "ae012e98-ecb6-4ad1-ba4b-f2ba8ec992a1", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745642, "uuid": "4d63028e-8f86-4c01-a84b-7797deec3e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745642, "uuid": "f007d0ec-adc5-4c36-a9e5-024b185e3565", "value": "eb471c9fa93384179f04afac5292de5da31695098c94c440e7144b17539a5c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd2047f-cfe8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764725897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764725897, "uuid": "a0c85b89-4a5c-487d-80dc-42848f6901cc", "comment": "Malware payload (Mirai)", "value": "8d46ec21d134b6424cf82470627b94d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764725897, "uuid": "1f6d13bf-5c1b-474e-9515-54c7cdcae8c0", "comment": "Malware payload (Mirai)", "value": "eb714b49abb26c3cd644abc6b6b74ea5a2b44dd17434d40fe2a5d1d0685efabc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764725897, "uuid": "8be9ad31-fb5e-4f47-ae1a-27c650ea0a58", "comment": "Malware payload (Mirai)", "value": "e33c98bff2d38d0222ff9ce2f254da6aeed59c73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764725897, "uuid": "0a64ebfb-fd2c-4e25-8290-6cc0dc3538e6", "comment": "Malware payload (Mirai)", "value": "70845a7533bcd79edfaa9a2a77d4b4f6cffa54f5e82c8a9679ba814bb91b26053357180bd5cff6f919c6a1f2d7e9e2da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764725897, "uuid": "c932a82d-59ea-45e6-ab93-1061d5597475", "value": "T12AE31945FC519F23CAC522BBFB5E428D37261798D2EE72079D252F24378A95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764725897, "uuid": "086ea5d7-0cc0-473e-ac90-41b4592446ba", "value": "3072:YgK7XW6DVjAwwcxlfi5/bSYwNmpEqs9DL8Ji5Bc5G:YgK7XWgpAwfD65OYwUpEqs9nYi5Bc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764725897, "uuid": "6aa4644c-068a-4420-9b2c-dc1dc30a6105", "value": 150912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764725897, "uuid": "969b357c-360a-46d6-bbad-870a07cf251d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764725897, "uuid": "be02b5a1-90da-4944-82a8-78f001b01b7e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32255707-d027-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764752721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752721, "uuid": "c11e47c6-4bc8-42a4-906e-88d45ffcb211", "comment": "Malware payload (Mirai)", "value": "c466bc4a58cc8627a68075654a9a6922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752721, "uuid": "d2437c6e-a63d-42e1-b9e6-73ad14ddb86d", "comment": "Malware payload (Mirai)", "value": "ec0572543a0013c2c8551cbc474e1ca131401b78cd53d4477c4e337a16537375", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752721, "uuid": "3c9fdf44-e852-465c-8aa3-c3cdb9bce90d", "comment": "Malware payload (Mirai)", "value": "3b28f1a989bf0598c66a68b7f02f9fbdb5467d81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764752721, "uuid": "45807ad1-2916-4bf2-af07-ad740a1086ce", "comment": "Malware payload (Mirai)", "value": "fece71eca84d0b681b0342a1cb9869da3668ff2a81204316cc652ee793ff714ea18a85f4f48c1df70190547abafe02b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752721, "uuid": "65a09837-02e4-4fca-a3d8-86dc1244b30b", "value": "T1DA23F1F4D3D02A86FB8D607117BF79ED5A14F31C209E5A12EBC0647B6F2AB50571C642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752721, "uuid": "b5e8cc69-827c-4417-be0e-65692bbc6f97", "value": "768:SOZUWDAoWXmNjndaGNDyL7sVFnuogr+5kjqUtbwED02/3xKzrlbecxN+QnbcuyDg:fZU57EjnI3LYFN81AYX/3igcT+QnouyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764752721, "uuid": "4316fe65-3544-4d67-b18c-47283817beff", "value": 46824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764752721, "uuid": "46cef164-65d1-4e02-a8ac-a2e82577f843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764752721, "uuid": "896c62b3-cd6f-412e-bbe8-29597429eb9f", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b39601b-d087-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793994, "uuid": "da8212b5-fafd-42d4-9a3f-81267131b081", "comment": "Malware payload (Mirai)", "value": "7f8ac94a74c58c459bc723dfa3f0b036", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793994, "uuid": "39b0931c-1974-4ff0-ac73-3b9bd7f88c8f", "comment": "Malware payload (Mirai)", "value": "ed71d4c8f7be4a5b3c2028efe7f89e79f85b4e19820a150eba7284f6c2db592b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793994, "uuid": "e95c0ba5-9fa2-4461-90a2-1871c5c3c4b2", "comment": "Malware payload (Mirai)", "value": "458cf1e8f1b7b53230cc9bb7f57e09fd542c201c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793994, "uuid": "87ed3555-ad2a-4c80-a356-1748a520db98", "comment": "Malware payload (Mirai)", "value": "b53b0b34f14a19d59faf9599720935217920402081853426948fdf1d5ff27e4d33175aa0faf0973c2b63e3f4ee7d4826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793994, "uuid": "805dbf81-2009-4e18-b9e7-e06f42c8e010", "value": "T1311301239692F304CADE05B964D5F4C79704925D7E0CA1EA9BC4A0BE3E1AF013F6C399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793994, "uuid": "67117def-8b20-425c-801f-733fcbbd67ce", "value": "768:/1vN4xLQwhaIc6MYAb1E73u70ewDcMJzZBnpb+CZ+wTerep5dEnbcuyD7UHQRj5:/2aLd43CwDcMlZBpbfnTer0Enouy8Hy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793994, "uuid": "0174680a-b96e-4dab-8c24-c018384e825b", "value": 41660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793994, "uuid": "cbc56622-8350-4733-9cf2-442c5b0b6abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793994, "uuid": "a37462a3-e03a-47e2-a52e-c0cb23eb04c0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61395ca-d04b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764768404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768404, "uuid": "573e1d8c-2639-46eb-bbf3-98cf18b3165d", "comment": "Malware payload", "value": "cf7cf5808e2848d51267879ff2ed100d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768404, "uuid": "24f1d749-6441-4ae7-a5c1-7d4a4c778b4e", "comment": "Malware payload", "value": "ee18d3656bac82951e19916f74a90ae41e4f9d34c53674dcb8a7fb85a5641d0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768404, "uuid": "4a31ff1e-32cf-4d79-a5d3-1f820e9d968f", "comment": "Malware payload", "value": "0e80e877ee76dba1feafcc88c0fb1496e276ca88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764768404, "uuid": "b26b75a7-ac10-42d1-a644-58346bee75f1", "comment": "Malware payload", "value": "35ab8f004b18e20f53f1f847bc302928be98382f76bf7b70c1ce3dd133eb74794c6f5b7276f7738a526ba41c7f83a20f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768404, "uuid": "a39d28d4-1cd2-4665-8a8d-a29ca1c2788e", "value": "T14F187D5263A609D6F9F79A348AE65213D673BC063F3082CF324C176A1F736E04976B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768404, "uuid": "47ae565e-1484-44f4-bbb8-d1b7ebc3ad36", "value": "764090509664248d5254caeebe1e7af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768404, "uuid": "e6e462e4-0580-431a-97b5-5b45c0953206", "value": "393216:Q9FZH1IL4xeG3pkiJzZstF9dmQQu+iOwUiTZI7FrKNx+4AshdaXmc+7jy464j1iJ:QZH1RHugrIjdIDVNQr8FyRhYpgPVlcmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764768404, "uuid": "5162f730-89df-42fc-a586-26579add31b7", "value": 86113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764768404, "uuid": "240a20c7-5ca6-4b68-820a-12df1c263447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764768404, "uuid": "f30a0af6-b0cf-4dcf-81da-165ee68971ec", "value": "eclipse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a36dfd-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1764770601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770601, "uuid": "2da4fb9c-74d9-4be7-a11a-2c0c6327649b", "comment": "Malware payload (DBatLoader)", "value": "8b1fb04f89430b7c75e74bb92db9f5df", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770601, "uuid": "6632465d-6028-4619-8dc1-856f400147ff", "comment": "Malware payload (DBatLoader)", "value": "f004a2047517380a7bad3e3817b98706eef99ead122d698f247bf5f6304fe475", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770601, "uuid": "7051561d-d474-4cbd-8b0f-f93fd33aa16e", "comment": "Malware payload (DBatLoader)", "value": "5997f95b9adf2cdd1c51e5db5f5462bd651ec52f", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770601, "uuid": "5d293563-47bf-4c5b-b443-e8b165190de9", "comment": "Malware payload (DBatLoader)", "value": "d17a169dd55adb28f406657dd641cad021d508be81b42d39e1165440bb07ba61f5d660f18ea887d433e0156f95274f16", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770601, "uuid": "8031256b-4007-4e37-923c-95fbc6b01fe8", "value": "T1C375D0A2A2F1847AD027D9F48C05939E5429BEB43E75A85637DC3F688F352753C221B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770601, "uuid": "0791a120-3c39-4a2f-a674-2a72641d41f8", "value": "eb41e5567017c33839f07ebe2eb84cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770601, "uuid": "46d64ef0-3ff6-42a8-b08d-e08af7c920a2", "value": "24576:sbCbz7++IfUFixpw0QB7FqyJ6ZFFggq/+G0P6mnBt3wJ2enjcjBjXdH:sbiFjbPqyJ6ZFeWGIvzunjcjzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770601, "uuid": "45c7c688-d389-491b-a431-1a3723d1de69", "value": 1644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770601, "uuid": "06eaaf0a-1722-4313-b355-8112bf7c4250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770601, "uuid": "b712fe67-1c7e-4893-86cb-c06493d76996", "value": "8b1fb04f89430b7c75e74bb92db9f5df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3d87d6-cfe1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764722723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764722723, "uuid": "785fdbed-c517-4f3c-8a50-75f46edb5441", "comment": "Malware payload (Mirai)", "value": "bde28bd23bbe6aa22cc1c82340f96a13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764722723, "uuid": "2af91be7-b3a4-476b-949f-2e5306873fb0", "comment": "Malware payload (Mirai)", "value": "f04f737fdd16534707045063a21f541df6f93346e6b1d4a9c0d955d5b728ed7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764722723, "uuid": "fc717e77-2180-422a-8db5-792220ecd734", "comment": "Malware payload (Mirai)", "value": "435b83a41b0f1c43887320d251b43c0205d36ac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764722723, "uuid": "7b20e65e-fcf4-4f5d-a53b-d64da6052110", "comment": "Malware payload (Mirai)", "value": "8dffc98d5d3d012e05e83940c07558cb9010d2e7206559a32756d2eef2d657200d0202116dfb73fd5a067c3eca0d78a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764722723, "uuid": "7fd3fe07-4be2-46e2-9917-b1f35912d839", "value": "T176F31946F8819F11D5D512BAFE1D028E33231B78E2DE72129D246F247B8A97F0E3B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764722723, "uuid": "46eb66eb-01e5-4d52-9a5d-d9d6818c598f", "value": "3072:aE3/Ft4ZdRQoqlGytfQoRa7zFIcuuJCzMInfk0:1/D4ZnHQtfQcanCiKMKfk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764722723, "uuid": "2b2774c3-b2a0-4f74-aa3c-48252ef18537", "value": 161116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764722723, "uuid": "321ec54c-e60f-4895-9f9a-11dd815120d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764722723, "uuid": "616509d7-2117-49b4-a789-f2414f06aa78", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926a0b67-d094-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764799697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799697, "uuid": "b12b219e-0b59-4e6f-98c4-7b93f3810b78", "comment": "Malware payload (Mirai)", "value": "136d0a668e7e4b6dd88893bbb8f5533d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799697, "uuid": "86437735-9635-4a54-a43c-fee8836b7fa2", "comment": "Malware payload (Mirai)", "value": "f064d969f25f36a06133df0d61b93e403b724a5d1a1723688f1902f77a518b0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799697, "uuid": "0d37d2eb-cf1a-41ec-b340-945926f6e1be", "comment": "Malware payload (Mirai)", "value": "bdcdbafad4f1ecbbdb3d809064f026550a0f5fd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764799697, "uuid": "74ebd1e6-50fe-4bff-bda2-972a990a9197", "comment": "Malware payload (Mirai)", "value": "4b4a0004535d4f876be6423bd163de4dc05864e6e372340ebfc9299b0e51c00fcd5868a7bec9436371b1db9d49d72db9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799697, "uuid": "bef4aa90-3f62-4493-9f84-bbcc79663b45", "value": "T1CFA67C4BF5A358ECC09AC430475FD663A931B89542317E7B3694AA342E77E305B2EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799697, "uuid": "889f5d9e-f2e8-4318-a379-b98a1bf1ad1b", "value": "98304:Q/YLrBIe6uK1JcVb28DTYtxeOmJosFNQ98s9PEqlWmEfpIawQW0OZkG4ckRUa3oh:QhuKpE0SUa3Gn8gMB+5qNnIFzAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764799697, "uuid": "d2cc87ac-cd0d-46c6-a47f-0020039d4d9b", "value": 10154696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764799697, "uuid": "80888184-c762-4476-8282-f008a96acb47", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764799697, "uuid": "eb823b3e-3ff0-4574-a4a3-cb96ccc0b769", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650fd1b6-d031-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764757101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757101, "uuid": "9cf8a61f-fd37-4c89-897f-c4afd83c302e", "comment": "Malware payload", "value": "e9ef30f33bacfad4af44f5e49ec04541", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757101, "uuid": "bc8a4c89-d573-4696-a8cd-2459df96cdc3", "comment": "Malware payload", "value": "f0b1d5a6b53c67f9dad5bc21c83bb06e61134560813d8b2d2913f1e5ae759745", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757101, "uuid": "d88af94e-56d4-4772-90e7-52f553540982", "comment": "Malware payload", "value": "1ca3c301b87bd0f8bbc1f1ff8aa4348b7c791678", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764757101, "uuid": "d7b37053-3e3a-4388-890e-358c372a2c6b", "comment": "Malware payload", "value": "287be4d86963f49242c5dc340c0597ac9f6d17c1fcc41f26731be63a6cf57a038528505f3b0b17fb252163a2885fe6c7", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757101, "uuid": "2012852c-397d-4193-98c0-9cfb12155747", "value": "T1991633B361F6A0EDD6027732EC63BA648469F16960134C3F7EE1CE267160684F93993D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757101, "uuid": "1bae5fa9-a425-479d-a779-b9b31ba1e948", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757101, "uuid": "683ad8dd-c6bf-47d8-9908-c075735f2140", "value": "98304:ONS+8OUHJg2ZDQKn3Fg7W8OGFcVgiloMGzNbCQt8:gSPtMKn1TPGFcVZloMGpbCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764757101, "uuid": "4c44cfa4-5865-4a7d-a222-61496dbdf2e3", "value": 4221952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764757101, "uuid": "0f9b4b96-7c3f-4c4c-a6ca-7a6e22dfff3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764757101, "uuid": "45ab967f-18f3-4c68-a7c1-4fbe51bc5bec", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441 \u0446\u0435\u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043f\u043e \u0437\u0430\u043a\u0443\u043f\u043a\u0435 \u0410\u041e \u0422-\u041a\u0440\u0430\u0431 \u211611863104 \u0434\u0435\u043a\u0430\u0431\u0440\u044c 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9a8e62-d013-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764744413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744413, "uuid": "7581d2cc-dc39-4c12-be67-e33b7391dd34", "comment": "Malware payload (Mirai)", "value": "44185e737bd0a9cece293d99cb3cffdd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744413, "uuid": "f1a2ea75-0182-4726-86a1-143aafe14e5a", "comment": "Malware payload (Mirai)", "value": "f0b29a983f8d41bd63c41107323a1a918d4d47360f230175532b9ed525c3e178", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744413, "uuid": "9b264011-0941-4fe4-8efb-f3ae93500a7f", "comment": "Malware payload (Mirai)", "value": "ebd19613dcd7c16108a53d5b3c5f8bfb7a7733ba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744413, "uuid": "73a8a67a-4384-484c-b344-d4e58a051a2d", "comment": "Malware payload (Mirai)", "value": "b2208b8241af9bf0ec3dafa197905c87ae137e7a80c65e347c4c226427ad4c0f639c8cf7ee96b01e8ae0389abf3b2e3b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744413, "uuid": "0229c530-1113-4f24-8990-d52c7f803169", "value": "T1B55174CF15CE97F0DDB5999171E948446CC2F697B4C3DE42E9E834A88C8ED8072D1E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744413, "uuid": "f4def339-353f-4e51-ba84-99a81d846b76", "value": "12:q0F2ZkNPVFKX0F2wkB7VFKX0F2oiko4fVFKX0F2RktVFKX0F2QLkQ2hVDVFKX0FM:vNUPtUIlYhZ7qOcQhVpCNC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764744413, "uuid": "2d8b8f4e-42e4-4197-a452-a5683b2fbbc5", "value": 2685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764744413, "uuid": "6823194d-8676-4b1d-b806-334a7667da95", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744413, "uuid": "aac3137a-3d69-422a-b54f-0c3a2398c4ef", "value": "aws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17909b1-d086-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764793790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793790, "uuid": "be9fc2ba-473a-440c-99d8-423335a86ebe", "comment": "Malware payload (Mirai)", "value": "f00bfa32bdcd627d193d9259fceb0cf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793790, "uuid": "80b72a77-a737-4bfc-a29b-034bc085d9fd", "comment": "Malware payload (Mirai)", "value": "f0da131e151040febbf2741de344d2dd7084d48da6c6b8ec3990cf34a84540c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793790, "uuid": "e5f144ac-0324-45c5-8742-19aa77fef108", "comment": "Malware payload (Mirai)", "value": "d2f98739228b0f296163ca84da4929a31ca64131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764793790, "uuid": "d0c9b336-8a9c-401f-8a69-cf873e00a441", "comment": "Malware payload (Mirai)", "value": "0e6f811c4e2b12c630c9cb8fe6a64811c822cdd349954306129e4ddd65fca140e9ba8e57a073e9b5a0af09ab073f8889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793790, "uuid": "f5f08310-736d-4a02-a9fb-1c6bf1d727d6", "value": "T13213025FE8F90C28C41DB1787E8DF59901D4E004CD8CC6D2DAA4649BB9B77C06B2AB23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793790, "uuid": "76d3649d-9880-4c30-bd40-f4b6dd6c2429", "value": "768:7oiPR50sFQj3ZXAeE0jC4Bid3GMTEuyaS8pRjcucpdMcU52/5/rKnbcuyD7UGQRY:7oiPLxF8ZQe44BiQMT46jc7McVrKnoua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764793790, "uuid": "c31ec8fd-a040-44e1-8b42-ac532127e256", "value": 42964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764793790, "uuid": "a16177df-082a-4fb2-bcad-3dd6aec5754b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764793790, "uuid": "b0f105af-5f40-4854-b240-69c3125ef9e4", "value": "zerobotv9.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ddb297-cffe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764735388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735388, "uuid": "c67c49fa-9162-469c-8387-25fa0d1816d9", "comment": "Malware payload (Mirai)", "value": "52cae6a78451b16ae57d5f73e5ef2700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735388, "uuid": "93eaf0d1-81da-4b2e-8269-ff8cb2eb9bfe", "comment": "Malware payload (Mirai)", "value": "f10bf215710daefdce98fe20c81c69b2d9cbae3d89e8dc67411ef27269d053d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735388, "uuid": "fad1171e-34a9-4b37-92c5-f6dcf276369a", "comment": "Malware payload (Mirai)", "value": "9f56708b43e306eacf6ba29682f6f2754b4f901c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764735388, "uuid": "14a9ef88-b575-46c4-a66f-ffcab4b1d57e", "comment": "Malware payload (Mirai)", "value": "7fbade7e49cf58a95db73c9049940bfc951fb10c01cbd5bf74cf6d92e51e22125c234a6caa7c93cf2cab61b54a1aec78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735388, "uuid": "01bd926f-44f3-41be-94b7-f0d5b2f2f1c4", "value": "T14E03F135D20AE5A5CE32553BC87D0D5D3C46A9B8E0FB7D7436282418A1B2A072FBC987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735388, "uuid": "35771c76-05b0-4d6a-a895-e8dffb5b69d3", "value": "768:vTz2aK3yQtlo+aJaXGc/jbApgS92gUQpgCuqupy0PrxOli948u97LW9q3UELb/:vc3y+laJ2h/SyQpiyZ49u9bLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764735388, "uuid": "43aedf00-8d1d-4dbd-93dd-705b8ce4eb1c", "value": 41380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764735388, "uuid": "bc6b0ef7-a2fa-408f-931b-66610c76b1d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764735388, "uuid": "281bdf1f-003a-47ff-9929-9b07c8ee240a", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762be0f1-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746822, "uuid": "fba521cb-86a6-4215-9fd7-bda1f6400ba8", "comment": "Malware payload (Mirai)", "value": "29560b28be6556f306353e23e1ee4770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746822, "uuid": "78a7f0f5-0db2-4564-9a67-ac2e401bdca0", "comment": "Malware payload (Mirai)", "value": "f16f375df54b3c485164167423f7278339a1f7d87f9384be20a1dfb57e131d89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746822, "uuid": "257830e1-97d4-4046-9a19-77d89fa926f6", "comment": "Malware payload (Mirai)", "value": "a304d58a9a0077f8adcf368b266d1268d74419dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746822, "uuid": "ddb928e3-f8ec-48a1-9267-c50969d31326", "comment": "Malware payload (Mirai)", "value": "59e68d50e96ff156bba6865af6ab7402f3594e194f57399c3f65e7f02092e7a4cb82f12f429ec1e844808356ede5e5f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746822, "uuid": "7ac2e8c6-62eb-4267-b8f9-df1894f3a4ac", "value": "T101E2E1D0C1C668F2C4B055709D52D191A21A1B2CA8FF757A792501B8BAF7C53DAFC0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746822, "uuid": "fbe3aaad-113b-4a81-b2ff-7d9c0b30c631", "value": "384:5ScUq2EadZHN/C8tzBqBk6reKiBdG6FS7kqJ+kIEVYjNkMpO9RYC/FrqIIXWyGG9:9P2vNTRC8BYJVSBkMpWlrez63UcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746822, "uuid": "fc04658d-01cf-40fc-9001-35dfd07da5eb", "value": 32560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746822, "uuid": "6439460a-5d87-4cf3-8651-57a46080bb99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746822, "uuid": "62204245-f09a-48fd-b82a-2283250efc39", "value": "Yboats.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc90c73-d01b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764747694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747694, "uuid": "dbce7d43-ba8e-474b-8468-9c62d9f19bfa", "comment": "Malware payload", "value": "e0ac399cff3069104623cc38395bd946", "object_relation": "md5", "Tag": [ { "name": "APT-Q-36", "colour": "#748642", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747694, "uuid": "1428ce88-3458-434f-a00d-22609276b3bd", "comment": "Malware payload", "value": "f26e2121d99464ea58901675395c7afed303c590eaa36add3562d73da6499741", "object_relation": "sha256", "Tag": [ { "name": "APT-Q-36", "colour": "#748642", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747694, "uuid": "afb7eb52-38ef-4848-b276-7a034048bb6a", "comment": "Malware payload", "value": "19a62bc33fe23d27860bd7c5d5a4db4d7e40194b", "object_relation": "sha1", "Tag": [ { "name": "APT-Q-36", "colour": "#748642", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747694, "uuid": "3d685f84-bd38-454c-aee2-f36ff50cddbe", "comment": "Malware payload", "value": "a32d515e6ebca3914cfb0a279571ff3b5ac02648bbf0b1d3968a10bbf66e80ba3e905e1391a0486050ca0768437c5d61", "object_relation": "sha3-384", "Tag": [ { "name": "APT-Q-36", "colour": "#748642", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747694, "uuid": "739d611d-1b67-474e-8ca4-f220e3349b98", "value": "T1D345E298D9C73EEAC9288F75D0913FB42314DC20F9269AB747241AC96FDB121DE131A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747694, "uuid": "97939fe6-391a-4f3f-896d-8333222da10c", "value": "12288:ahGyLlQepWR/5JvbC+XPlTT5QvsiMPxMPrcbJ+2r:3DeQRBJv/Xv3UYbJfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747694, "uuid": "69ae0b42-8de5-406e-aa1f-03959a9813ba", "value": 1243431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747694, "uuid": "057029cd-ff81-4515-8bdc-6203c0524eea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747694, "uuid": "99771bc5-c35a-43e3-9247-55e7d17f02b7", "value": "List of officials nominated for rewards 2025-2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0f2c64-d017-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764745921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745921, "uuid": "aed0f1fe-45b8-400b-a265-4ad4bc131d93", "comment": "Malware payload (AsyncRAT)", "value": "44ae176d840658f396b4b5c32bdef1e4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purerat32-duckdns-org", "colour": "#36BAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745921, "uuid": "83a5c261-4eca-4993-aa28-a55d335a8421", "comment": "Malware payload (AsyncRAT)", "value": "f2798987ff79bfd4a9cf2b5877ae520d4ed823912f5338e9bf3c4735c70859e2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purerat32-duckdns-org", "colour": "#36BAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745921, "uuid": "24e78735-3715-4c7d-a70a-8357f5d26efa", "comment": "Malware payload (AsyncRAT)", "value": "1ccb73689b7c341c36de790ed21b3f6e71d5d741", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purerat32-duckdns-org", "colour": "#36BAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745921, "uuid": "d8f8c980-47f4-470d-b91e-27108ac4e02c", "comment": "Malware payload (AsyncRAT)", "value": "3ad6ad62c3d65bc294297ce92f6f3a2d54426c3dd2113ecda9115f447869ad7af736ab4cc652a6b3d6477e60933da87b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purerat32-duckdns-org", "colour": "#36BAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745921, "uuid": "a498fd44-e7cf-4caa-b16a-8af47a3b0991", "value": "T17CC42309D399F43AC7A08F76B4FB0E400FF5A9619193E22E16EC5B192A97363CF57016", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745921, "uuid": "be4d78eb-f4a9-4b75-b94a-e89cf5f7ee92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745921, "uuid": "53a1a8e2-3dd4-410a-b17f-ff2b647551e5", "value": "12288:q9EDTUrDrnSyb6fZFnkOCcuIMGFXeAGRbeXu/t1vsafGuOwUScOr0c+hgWZ:q9E/6QRFFurSXe7RbL/tejuySvY3gWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745921, "uuid": "b78b277c-c6f4-45ca-ac8e-6dd0fbbdd19c", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745921, "uuid": "9072dcc6-9640-4f05-bd93-89bb3366a4f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745921, "uuid": "1094ac49-9baa-4d68-803d-eecd4f322953", "value": "f2798987ff79bfd4a9cf2b5877ae520d4ed823912f5338e9bf3c4735c70859e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf88eae-d02b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764754727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754727, "uuid": "f98b3d5b-4296-404b-94c7-37768617388f", "comment": "Malware payload", "value": "505b0cc0a9bdd4263704fab251abb6ab", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754727, "uuid": "00b2bc2d-056c-4cc9-b77a-62709d52959a", "comment": "Malware payload", "value": "f2afe4a4309c2892a499fd774513c3d97d5d1bfb18c2dbc2704168fd548a0820", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754727, "uuid": "2435b6e9-ec1e-47f6-86b6-b223e0d442bd", "comment": "Malware payload", "value": "108325a7da2ae74c3566fdb5e391fc44c5ce6e0f", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764754727, "uuid": "69e7ce51-7ba5-425f-9e0a-a89600f3dfff", "comment": "Malware payload", "value": "756f66716537c55b967926319213ae61d37939589471207ee905adc262e0dc6e53367ffc36e9a4bec0948db8286c5b05", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754727, "uuid": "202dbbf4-232c-4993-aa6f-c2360f00d98f", "value": "T142F433A52305FA3FD7E03DCDCB9A5C95E0E4161863B5BCA36939860E150086B6F6CDF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754727, "uuid": "69374c01-087f-4be5-93f6-53dbb0fb7d60", "value": "12288:MDDaU40xHTXLRWgFENxWzqLpddNbH8Lq1/ReIimtcGQTSBJHeoXM+l90rMQ0ssSr:urBJTbR8NMqLkLmDPcdTSfHMMQd1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764754727, "uuid": "2b25b7c2-6ee0-44a2-aec3-f40419c23838", "value": 726779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764754727, "uuid": "2a6e88f8-72e5-4efa-bcaa-d3061949d3fc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764754727, "uuid": "6409f9d9-ea8c-47a6-be8f-5b3083ba4755", "value": "Comprobante.transferencia.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fde0d0-d06f-11f0-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1764783971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783971, "uuid": "38513b83-83bf-4c2f-97a3-31cb083e70ff", "comment": "Malware payload (XoriumStealer)", "value": "dc75e637d2e639314252bd8c2d72c5cc", "object_relation": "md5", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783971, "uuid": "3bebbfca-d24c-4c4d-abf4-f68706da2ee5", "comment": "Malware payload (XoriumStealer)", "value": "f3875443e6c73a5f6d67ff49d2c03c67effcc9bc30baca62c3b46908d4dfaaa9", "object_relation": "sha256", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783971, "uuid": "f8e60da2-e85c-4454-a0d0-050064b8f53a", "comment": "Malware payload (XoriumStealer)", "value": "97423eccc05a0b407fe6a1015c34d1d5413c53e2", "object_relation": "sha1", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764783971, "uuid": "cf15b38f-2b2d-403a-9b72-fcfc890eb097", "comment": "Malware payload (XoriumStealer)", "value": "ea3184d7ac869eb93b11169530ea7ba8c41bd7ca9d9bf22c3c1cd758aaf45f892d75c2d266df1608df37eca9751aadfd", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-107-99", "colour": "#A43264", "exportable": true, "hide_tag": false }, { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783971, "uuid": "cfb1a04e-84ab-4152-82aa-6d39edd7f89f", "value": "T1B9965BF636C1AA9DC51AD4BA8353F97E8A9FB4318E1BE4939046736ECE13C44B114F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783971, "uuid": "b8d8b20a-de2b-4dee-9d30-c59ca4ec9f4d", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783971, "uuid": "3260f4fa-f0d2-4d16-b183-6ba07263d6e0", "value": "196608:W1sKROCRxIufgelWteub9HE9brznGLFeq4C:pKRDaufgezMObrLWAvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764783971, "uuid": "a7b62781-9f80-40c4-a1c0-135b367abc6d", "value": 8616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764783971, "uuid": "4a7e3960-950b-4ee5-bd05-27dd7e04654d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764783971, "uuid": "da41fbf3-ed89-402e-be50-e5ce35a497e8", "value": "falcon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1641da9e-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806361, "uuid": "61b2a949-72cc-4e37-b03a-35a21bea8ce0", "comment": "Malware payload (Mirai)", "value": "386443939909cd5a297ff36f05e1b210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806361, "uuid": "036a6496-7ab3-4ca7-a133-742a9b2afa9a", "comment": "Malware payload (Mirai)", "value": "f39aaa679217272e6a14357ce966226f58d73ed3388b075d04be1a5317a88171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806361, "uuid": "f7b64a2d-acb0-4492-8cc9-57833535c6e3", "comment": "Malware payload (Mirai)", "value": "c5f50d9b14d1cd28eb113a37c5cfb20500e2038d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806361, "uuid": "32b1500c-c4f3-4d1b-bf09-f88a8ad748e5", "comment": "Malware payload (Mirai)", "value": "06ce0938d881850b0a06ee8b2c8472dd672ffde9986c4f9b6c3eba82ec0e24ce58749c34c751b40e3586ddf38222d7dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806361, "uuid": "9992aa90-f472-4cdc-a49c-74edd098d210", "value": "T1F1935AC9E6C3C8FAEC1605322072AF37EDB3D57E3135EA83C7A99539AC62541D10669C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806361, "uuid": "00fd7c95-5b1f-45ae-ae8c-ad9fb3381a88", "value": "1536:m1rA+nWGc97U98Vky/qi0ktZulA96yqf86droSZhBc:mO+g9dky/httAa9VM8UhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806361, "uuid": "ea03039b-0c24-4c3b-a98a-0b86c6b2b2ce", "value": 95572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806361, "uuid": "6be6abbb-5934-47ae-9252-17b2579f3d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806361, "uuid": "839362e9-7202-4e29-8c49-c0b1bc1bf353", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ff98a0-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746959, "uuid": "958bddb6-261e-455c-9444-0d4894ebc8de", "comment": "Malware payload (Mirai)", "value": "902bda20bdb73eff9af9681b7f3028c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746959, "uuid": "c3c62c86-0548-45c4-8e3e-313d3ca44ac6", "comment": "Malware payload (Mirai)", "value": "f3d62ef5384d652eada72ac38603793a332e7ae74def72f6d20c5c5afe6e87df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746959, "uuid": "05eb704a-a0dd-430c-aed0-ec9aef036b8e", "comment": "Malware payload (Mirai)", "value": "199563f96568b78eb9bbc637fcdc3043417f3807", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746959, "uuid": "aade2a1f-6886-440d-94bd-b87bb5a37176", "comment": "Malware payload (Mirai)", "value": "fa0b81d834023186026152dba0a420028b22ef2aa58b192df4981f4dd2d514f456d0cd99183fe9057fbbbc228aa28050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746959, "uuid": "c45c6da4-b6b0-44df-9914-2c1f1de2f805", "value": "T1B1B35BC5AAC394F2DC0046B5306BDF328972E5BE012BDBC6E7ECDD3BA959521840729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746959, "uuid": "3fd09724-451a-4dd9-b65a-cf47c93d2b94", "value": "3072:x6t9FpC9tHJ+HAJD106TvwuVgC9iLAgRPYNp:YT3StH8HAp1XwAyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746959, "uuid": "f49635c8-a7fc-46b0-a4ef-dbc8b2db95e9", "value": 112016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746959, "uuid": "38f9812e-9ad2-41ee-9d30-f97ce665a735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746959, "uuid": "4ba7c460-8517-45c2-a782-b868d00d0236", "value": "Yboats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9596e73-d044-11f0-a129-42010a9c0007", "comment": "Malware payload (NodeLoader)", "timestamp": 1764765376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765376, "uuid": "bc1cafb9-0b5e-4e3f-a7f3-850c66924257", "comment": "Malware payload (NodeLoader)", "value": "09e12c19efbbe71e14a9e1237601fa0d", "object_relation": "md5", "Tag": [ { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765376, "uuid": "cbb4dd2e-62e9-4d65-b3c6-b4bb9defe056", "comment": "Malware payload (NodeLoader)", "value": "f3eea014b62ad931bd1a903ff986eb333f3429f9e02b2c2c4411ab29d60c46d2", "object_relation": "sha256", "Tag": [ { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765376, "uuid": "69d45477-25fe-42f0-a040-6d591b4e85f5", "comment": "Malware payload (NodeLoader)", "value": "6fab0c754aec3c847afcf58761b425dec232c239", "object_relation": "sha1", "Tag": [ { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764765376, "uuid": "66ef0873-a177-4caf-a404-e33c0e8b035d", "comment": "Malware payload (NodeLoader)", "value": "943613b8aa8402649f7440774480351a867ecaf3f95dfe0bae93ffd82c5918c2da74763337aef138d9b0eec2b9c24c2e", "object_relation": "sha3-384", "Tag": [ { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765376, "uuid": "8f4b348f-eaed-4cf5-b23b-d02dae1f78a1", "value": "T15B7733E9B535C2957C8FC239DD31A05682A7A272FF420979F05493F7AAC27E4F9AC005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765376, "uuid": "b575e30e-35d4-4f77-90af-327b10d7db8e", "value": "786432:s10frPdgj2IpTKMLs7T95jY5YvC1CfpmEc+4Bd3awSG82x51:s1UrPOCIpjsT9FYuvCpER4Bd3am51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764765376, "uuid": "080a87f8-c09c-4de0-8484-06cfab1d0bb2", "value": 34150517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764765376, "uuid": "0a28a3b2-b287-4e5a-a5d6-e60ec4d25bab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764765376, "uuid": "4306f9e3-547c-4f3e-82b7-438884d26709", "value": "Xeno.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e315ad11-d091-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764798544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798544, "uuid": "6c5320b0-ff4d-48b3-931c-ca1fa896c108", "comment": "Malware payload", "value": "f623fde67b6656aab6a28d8a067f4b60", "object_relation": "md5", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798544, "uuid": "559386f3-614a-45a5-a1c0-efeac53c621d", "comment": "Malware payload", "value": "f453fbd443763b479d47e3e5699ab2b3c7279c88b0d6b6279c8ac6760f02f165", "object_relation": "sha256", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798544, "uuid": "554a74c6-b8f7-4186-b978-81a35baff5cb", "comment": "Malware payload", "value": "5ebc560533596fc1d6df5b756042ee85745a6fe8", "object_relation": "sha1", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798544, "uuid": "75940540-47fc-475f-bd86-43522926d415", "comment": "Malware payload", "value": "23fc59457f5f06eeff553ff9414b031fb8aa818dc1e511daa51f761f6453519d6d1f6c48c4ffacb593a13efe137c2ca5", "object_relation": "sha3-384", "Tag": [ { "name": "github-altingalting01-hash", "colour": "#CB8193", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798544, "uuid": "2f4b6278-7bd2-466c-816e-4119d97f7a21", "value": "T1911633113B4DE557E20F613D974591323D28E48B7B0AD0E7A26C048D879FE53439AAEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798544, "uuid": "ac640562-b698-430d-82d0-bfbbfe9b04ab", "value": "98304:S/gqf617gQzh5VSI8lUoxJwv0EPaAN7yHNQqidVYgcuEHhtoNS6J3:SY/15VSxlU0wvtaANYSqcMdoNxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798544, "uuid": "c2890be3-6695-44f2-b74c-467fa6cf3085", "value": 4177564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798544, "uuid": "f613e6fe-c60f-44bc-97d7-7e234b972674", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798544, "uuid": "46662245-71bc-4e07-a2c1-73ca96212033", "value": "Shriek-2.1.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6947382-d013-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764744433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744433, "uuid": "a67d62a4-bedc-4f11-b8c0-ec62ff16bbed", "comment": "Malware payload (Mirai)", "value": "00eb97dc399f3cf1a8cc3f648c0dddc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744433, "uuid": "d4fc31d9-fb9f-4f80-bdf4-5b13a695b1ec", "comment": "Malware payload (Mirai)", "value": "f467048a558a303bb3e3a16d1580fa30804937091db5c35be7e91097429bbda9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744433, "uuid": "b9e55571-8b96-4587-8986-2e2c733f528a", "comment": "Malware payload (Mirai)", "value": "51c49972801f88a9622e8ab8a0d570939ffdcbc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764744433, "uuid": "44083bc5-8e48-483a-a44c-5fd20b8e9da2", "comment": "Malware payload (Mirai)", "value": "5d79dcf38adc04a42303a7c03cd9c79944e58f2da10ea5f29df33661d3bf78ef0aa89400a1a7d695cc72c44b3b17850e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744433, "uuid": "5616e256-5e10-4652-ab0f-3940784ac2b7", "value": "T173932982BC928A2AC5C013B9F66E66CE3361A3E5D2CF3217CC154B1277D560F4DA7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744433, "uuid": "c2fc3721-9a4b-4724-b194-0dee2a019d03", "value": "1536:Jk88tzdpG/fHtNh2mLecVstEWA70WnU4RlWxnLVICv:Jk/tzTizTRlkRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764744433, "uuid": "da9af550-a6bd-497b-bb87-2ff400c4ae1a", "value": 93196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764744433, "uuid": "11282dad-e32d-4552-ba8c-6228b599b8f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764744433, "uuid": "25c14e11-8587-4e52-9689-9df49a9091d5", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841750d6-d012-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764743839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743839, "uuid": "3a062216-0bdc-41b9-98fa-8c0659129e84", "comment": "Malware payload (Mirai)", "value": "505b0d9ed8f1f29e671d43ff99f8ba8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743839, "uuid": "a89d2003-9e1d-45c7-8cbd-2b173aa0bc34", "comment": "Malware payload (Mirai)", "value": "f46ebe7b0751330854b1ceb0427b2d57c7dc88560e1adc3ee095794236b7b719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743839, "uuid": "32e4f5b6-952e-44a9-be74-943d0a7608b3", "comment": "Malware payload (Mirai)", "value": "71b092056d3d4c9e52444fed4d8a213fc90ec84b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764743839, "uuid": "8acd6a65-81ba-42e0-a617-766cd2762d33", "comment": "Malware payload (Mirai)", "value": "2ce15e1ff55ecefdbdeef1b00eb6961138df6c09d3760ad278fecf862c90dbd13dfc0f32de54bc146d75f94ebc485948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743839, "uuid": "31bfb6bf-85ab-42ea-b46e-55b7aab50d50", "value": "T132E3C609BBA11EF7ECAFCC3705E91B0128CD551622A97B36B534D918B64B24F26E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743839, "uuid": "0f00da43-7a8b-4e2c-a34e-e2bdbc113a03", "value": "3072:hmmmjdIkGGhGlYZsxOCcSELPeQi89cv50KD9:hmxjdIkGGhGlvxbzE6Qi89cxBD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764743839, "uuid": "998d87d5-50dd-4173-9acd-6d7c41d86926", "value": 157160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764743839, "uuid": "090ee065-c73d-4c7d-ba71-9aee03fdb3d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764743839, "uuid": "55949c19-0ace-49c4-a23d-f15df03b96be", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febf7207-d016-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764745763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745763, "uuid": "31fa5cca-ea02-41db-937c-61ce306bfe57", "comment": "Malware payload (RemcosRAT)", "value": "d9358ba74c28adc892b4f8919fbbd198", "object_relation": "md5", "Tag": [ { "name": "remcosf2025-duckdns-org", "colour": "#ADD987", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745763, "uuid": "720dcda9-a84e-45ae-9078-6963e4920ff9", "comment": "Malware payload (RemcosRAT)", "value": "f49e6e84c10ffdd05fcd7f49c6616f25f9385710009bc3dab7cc35bb212676d0", "object_relation": "sha256", "Tag": [ { "name": "remcosf2025-duckdns-org", "colour": "#ADD987", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745763, "uuid": "f5d781b2-88c7-4b66-ae2b-ee959c85b747", "comment": "Malware payload (RemcosRAT)", "value": "b4a14c855506f279976a380eab21c1a51c5cc1de", "object_relation": "sha1", "Tag": [ { "name": "remcosf2025-duckdns-org", "colour": "#ADD987", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764745763, "uuid": "87f851f4-716b-4be4-9700-06dda44c8a17", "comment": "Malware payload (RemcosRAT)", "value": "dd562518fbfb5e59b29c62918c522f149c837f41c1a2484975ffdc68c3fb5117f6a7048d1436041be4e392901c85dd00", "object_relation": "sha3-384", "Tag": [ { "name": "remcosf2025-duckdns-org", "colour": "#ADD987", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745763, "uuid": "083ae85d-a5c5-4fe8-abd7-37cd4c568026", "value": "T194361A811131BC1835F4357D6B21D5126E9DA5DE84FF8B7F28DAC288BC6EB08C5ECA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745763, "uuid": "986cdcac-dd0a-44da-89f0-e4e1a54a069d", "value": "96:6tptptptptptptptptptptptptptptptptptptptptptptptptptptptptptptp2:codRgmWpfdKZD7WDZimM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764745763, "uuid": "3ecc144d-2179-49e6-ae2f-dacc138fac38", "value": 4867496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764745763, "uuid": "86c4bb47-8485-44d8-85fb-57ad7209cb5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764745763, "uuid": "7bb6f599-9a38-4902-b0cd-32dbf25a62f1", "value": "f49e6e84c10ffdd05fcd7f49c6616f25f9385710009bc3dab7cc35bb212676d0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c48900-cff1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764729556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764729556, "uuid": "d36406dd-ba36-4ab3-abf2-83d7aa5b48ac", "comment": "Malware payload (Mirai)", "value": "bdb5f429184adde8104a03185450df95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764729556, "uuid": "850c80eb-20b6-4cf1-bf4f-173e88dd6864", "comment": "Malware payload (Mirai)", "value": "f4fb80f3436077aa3023cb662858ac662a88b9a7fdf2179d06205d7ad624e75d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764729556, "uuid": "dff53832-7d77-46b0-9330-75febdfdc9e8", "comment": "Malware payload (Mirai)", "value": "97394bdc052b2591030cca11d33526883ba1467f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764729556, "uuid": "7b3c5011-fab2-49c7-85a6-52716dc9ec84", "comment": "Malware payload (Mirai)", "value": "a57b639e74bcf3b88fdd833933871956fb1267fb59ca05ffa12eb6c6517128927d7b6526535f8558a8dcf3d205527aae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764729556, "uuid": "845aee3b-b8ec-43f8-8878-1866b61bb6e5", "value": "T1E2836B53B984C0FCC09AD03447BF7236C863B07D1278B19B67D8FE267D89E601BA9995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764729556, "uuid": "91b033f5-4e6c-48d4-8d74-836c6183a41e", "value": "1536:IzH//qj36Be0wT8zj6FvTqlOXMo6WrM51QM0LUGxr7bULr9:IWj36BSTQ6So6qI1QM0pr7bUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764729556, "uuid": "0bdf646b-e4b1-4d46-88ac-529ccfe84bbf", "value": 82784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764729556, "uuid": "efa16b91-7457-4a36-a303-ec85bf419bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764729556, "uuid": "21d75dbf-c7de-40c4-87b0-be4cb1e8b54b", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f868c3-d07e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764790172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790172, "uuid": "b5b3f49f-38f4-4a35-b9bc-081a9e68c1f0", "comment": "Malware payload", "value": "a2ac78fdd356856f7806d26761b6adfb", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790172, "uuid": "d2cf14be-3c4e-4428-a3d0-a3145e4db6ce", "comment": "Malware payload", "value": "f53b3ab9c9927c3e813e7c1f730c39cb4c728bbe35fd5d2fc522c8dbf17ae077", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790172, "uuid": "442fa7ec-38f9-4178-a91f-8b542cf1abb6", "comment": "Malware payload", "value": "f192cb35683087a65b5a1092204d634292fef95a", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790172, "uuid": "97b5c032-a254-4a17-9975-84199fe9b85a", "comment": "Malware payload", "value": "4e550b8294de1d9eab547e263cf7c6e1e53c6d1777d4841f1f901572a570c0cb95f7adc2835dcf16311039e17869548d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790172, "uuid": "382197f6-ebd9-46b9-a248-f2f0198f1d32", "value": "T104C4CFD39A3B92BAC05D60B5A3A44344E017B4BCE324376F11C769B124A4F7F2B6753A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790172, "uuid": "8d879ebe-4f86-435d-a3c8-5b08201106c9", "value": "12288:7HXnvQY1BhQc7rLIshXKoek4e1Z/////////X////////pFuJWsQnj:j3FBhQcLhhXK+/////////X////////V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790172, "uuid": "1bc6b557-bc86-4707-b2e5-b0592ce37abf", "value": 567186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790172, "uuid": "883890b4-58c6-4db2-95e5-dcf8f698231a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790172, "uuid": "4bc235b7-ddf3-4e6a-9522-817d0f29026f", "value": "2025-01-28 v 2.0 Monthly Progress Report_838_version with SC.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5718c7f5-d081-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764791437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791437, "uuid": "6f612bc7-77c4-4306-8f8c-71fe12178411", "comment": "Malware payload (Mirai)", "value": "dd9056fe92d77aedef780b57f47f8bec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791437, "uuid": "1ddb7a02-9f00-42f3-8d38-8b2114fe8cdd", "comment": "Malware payload (Mirai)", "value": "f55716f51189099cfc24281d8355af9eca0628950bc76a9d331b3d19cf25ec89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791437, "uuid": "6909e601-ddfd-4b31-bfd7-63945ee2dd1d", "comment": "Malware payload (Mirai)", "value": "8329f845b06b379ba784550d7088024b40755ba4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764791437, "uuid": "9271433b-488f-4a77-a075-19598ed0f228", "comment": "Malware payload (Mirai)", "value": "925f3ec7246f6ab556f50224311043058e2a8dcfdb72c0e0d34a206f9ccb2ce9e65dbd912e21808c1d5bf239b1da57b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791437, "uuid": "268eca4e-aa7e-4cf8-b722-5721afa580ef", "value": "T13913E069031244EACE81F0FCDFE44F921B293F5BC80F8DA56962E95BCC8A1B47CD5589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791437, "uuid": "f8367185-fa4e-4e0e-97ac-7988341b33a5", "value": "768:lH63cEtjr/ciLDEPv3PPMRMdZrIopQOKwpo0AycP1/s/oKmN/w0rKqJgGlzDpbug:lH4004ZrPpQOKwpo0Ar2la/FbVJuuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764791437, "uuid": "2f9cd82b-5dc9-4537-9368-edfa2bebd57c", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764791437, "uuid": "0c8d3a9d-68ac-42d0-b029-223b9c36c72b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764791437, "uuid": "5d8d110c-e1d7-44bc-9619-271ded83ca01", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e9e2a8-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767360, "uuid": "7647abb5-ff7e-42d6-816e-0644dd3eb9dd", "comment": "Malware payload (Mirai)", "value": "567906a642fb191fbb4f8b4b8db78bcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767360, "uuid": "084403bf-8367-4d16-9e5d-e8007ef3767d", "comment": "Malware payload (Mirai)", "value": "f57c58e092ac6dbc10f8d1bf53668baae192624b34dba81548e6dde4105afed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767360, "uuid": "19a801a0-8448-46eb-92e1-e9cc0eaeec70", "comment": "Malware payload (Mirai)", "value": "c5ab453e1a5a8ff12b2b980b61d9fce529396db0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767360, "uuid": "70615aeb-23f2-4d58-954a-e606ea03ca72", "comment": "Malware payload (Mirai)", "value": "37e1bc921030eca50e9160c60f6de9dbe3d4ecd40c96ddc2daf1e11fd701eef593695e8086695faa4ef5b2e6f4e80fc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767360, "uuid": "de078638-5242-4cef-9562-a5542e0925e5", "value": "T17553AE77C8396E64D25581B0B8748E792B53F88482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767360, "uuid": "0826e42c-ff36-42b7-a1e5-1c327e82e4f8", "value": "1536:caCwtuAPFqcgdEcE5KU3AwHup+CSXHld5Zo:c58PMcga9AUHup+5FPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767360, "uuid": "ca3e986c-d09d-48c1-8a41-41f66696ca4c", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767360, "uuid": "9854a31c-f021-4485-8bd6-b20a7fe14295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767360, "uuid": "7d109d3a-b15c-4bb3-9aee-1106b6c2d522", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4ccffc-cfeb-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764727206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727206, "uuid": "9e5d57c5-8dd6-425f-ba58-ae0fc6d4895b", "comment": "Malware payload (GuLoader)", "value": "fe5569462d9ca145f78bc520e1e9a53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727206, "uuid": "0b39eac3-f96e-4ca7-bda4-855fdb6b4b5f", "comment": "Malware payload (GuLoader)", "value": "f58c14370ca887ef557112732534fa842b8e443719285a962f1a4d66400a7123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727206, "uuid": "31a2eeed-300d-4f56-8fab-bb4a570c6984", "comment": "Malware payload (GuLoader)", "value": "20a1b6463a9f57b58a89995c193c391dcb1faef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764727206, "uuid": "6a4e9dfe-6e2a-462d-9f4c-ccd91368296a", "comment": "Malware payload (GuLoader)", "value": "b3159ebef23a979044faab70f164c8a207b3df38feb46cd2272b4dd232f361e01dbfa8752b13ec79353cd578fc04c9fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727206, "uuid": "5685016a-305d-420c-b106-e7da10490414", "value": "T19CE401C2B250E426F3CB10B0D1BA9DFADA796DD9E48747176601BF7E39332A2401974B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727206, "uuid": "e154d8cd-e6dd-40d9-bd49-c2ffb30595b2", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727206, "uuid": "2c7975ab-c76c-4579-a386-e3a8a3939256", "value": "12288:9kTBokdIW//D6gMx1ySwExWKVMPI+SOUe9c+mCJD9EHezRH++Sq9:+tNdIW/r6gMxzwExWWk59c+rJREHep7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764727206, "uuid": "f174321e-4874-48b9-bdf2-b885b46d4dee", "value": 663032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764727206, "uuid": "514f54d4-08b8-4691-bd9b-57f6f0efb5df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764727206, "uuid": "17ed3a1c-4e6f-44e7-87d1-43ae9a3148b6", "value": "rFactura-11-03-25-00000118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caff089e-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload (DeerStealer)", "timestamp": 1764749541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749541, "uuid": "81f7f42a-24f4-4048-94f3-06d0c2703f47", "comment": "Malware payload (DeerStealer)", "value": "46a6fb151333e4085e67c45d4f4bfbf2", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749541, "uuid": "17ef90e7-a361-40ac-8a2b-fb9ed204026a", "comment": "Malware payload (DeerStealer)", "value": "f5d54923c88c02c07fdcfd9af1d99440faf7ea6fb3744f2d4cdcf5898b504eb8", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749541, "uuid": "6f52f4a7-fcfc-47a6-8445-8772f32ac1e2", "comment": "Malware payload (DeerStealer)", "value": "4163b57dee879392310c0fda830e91ba9571f9c3", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749541, "uuid": "ca8fbec7-e6d2-41f5-b733-4c352e378503", "comment": "Malware payload (DeerStealer)", "value": "f31a4a2926ce08365b10731436a7b04946f6725af953b49ff649faf9f50c749dae21c4cfffd3acb32ec8a3454286faa7", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749541, "uuid": "ec021119-aab6-4dcf-86f8-89b0b1528436", "value": "T17BC08C2AE1492224C16A86E1A001966FD6EBD48C6D4C2CAE406C0C463742AF25BEA5C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749541, "uuid": "fc5c2e2d-4c27-42cc-bc59-4b231a60234c", "value": "3:6rivEmiNOaQB8TBAnfxHuaXACSD3TH3x8JNNyFwJAFBK8QT5KMFIwpxR6TA:6sJiNoeBAfdoD3Lh8JN3h8c5KMFIsXeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749541, "uuid": "6047a1d6-753b-420a-9fa1-1d13b406c6d0", "value": 171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749541, "uuid": "3cc91335-a65a-4bf6-a5d6-9f0af6b7b8ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749541, "uuid": "d0148139-eb99-42f2-b34b-7bdf2f4068e1", "value": "ex.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f7cdfd-d070-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764784087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784087, "uuid": "c569fbcd-1dca-4669-bd68-9c95c42bbaf6", "comment": "Malware payload", "value": "cbfbe38d6d07b123d0561f733496ffd0", "object_relation": "md5", "Tag": [ { "name": "151-243-109-125", "colour": "#E68FCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784087, "uuid": "7613f266-16a6-44c5-8b53-8886c796c716", "comment": "Malware payload", "value": "f62398daecba243e7401fbe3eaa050c1b56ec185484e9be4f914c4f68b988a0d", "object_relation": "sha256", "Tag": [ { "name": "151-243-109-125", "colour": "#E68FCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784087, "uuid": "792d85a7-7c18-41d7-bd5f-8027a09bf729", "comment": "Malware payload", "value": "a5af08e5d5ad92940bb9dd050de54c046e8a6c86", "object_relation": "sha1", "Tag": [ { "name": "151-243-109-125", "colour": "#E68FCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784087, "uuid": "9bdc7e17-01ef-464c-93cd-34f59623b9cf", "comment": "Malware payload", "value": "4d1dc3377b72f1894c94415bb6dc04633ee70308c8bb763f0a1148900f127ccf96970aa1244be4116b464f8578d76d42", "object_relation": "sha3-384", "Tag": [ { "name": "151-243-109-125", "colour": "#E68FCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784087, "uuid": "f13dcee1-37de-476c-be3d-404d53162c77", "value": "T1482833CC61970857FE91807653E449BCDFAAA81EDBDE829FBAF003001E631D59D39B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784087, "uuid": "9b7cd23b-8b65-4302-8b32-28a78af8d2bd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784087, "uuid": "c2289bc0-10e0-47e5-9b94-d8fa45bda22e", "value": "1572864:lEWkWJYTYJB4EtGS3hfViIoaZASuJcppKswSX35Q8qcnwJw1q7tz9HEVB9fcjXG:lEWkquOB4Etfp1iSuepgSX8cnw8iz9oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784087, "uuid": "9419ad17-fc49-481a-acbf-21def0b0b9f0", "value": 100307037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784087, "uuid": "265d8f13-61df-4928-b977-589930650ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784087, "uuid": "d61ce248-aae4-49ab-a695-0428c9d29981", "value": "VoicemeeterSetup_v1120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f924a7d-d021-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764750086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750086, "uuid": "a3a71a15-11c0-4dc0-b420-4565188999e0", "comment": "Malware payload (NetSupport)", "value": "81d8593e1802f55983bac34198694b55", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "geolixin-com", "colour": "#ED806B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mauserfizko-com", "colour": "#73546B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750086, "uuid": "54024472-f36a-4695-a49f-b241b279b12d", "comment": "Malware payload (NetSupport)", "value": "f633c887716649ec623accb8a672cadc670c9d70971122b9f451ddf954615cce", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "geolixin-com", "colour": "#ED806B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mauserfizko-com", "colour": "#73546B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750086, "uuid": "287c3289-9235-43cb-a78e-a29c20d2452e", "comment": "Malware payload (NetSupport)", "value": "4d2fa04fd2286e180728d6264f8d093afcce4b29", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "geolixin-com", "colour": "#ED806B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mauserfizko-com", "colour": "#73546B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764750086, "uuid": "805c8bdb-a7b1-42d6-8bd8-bdabf108e95a", "comment": "Malware payload (NetSupport)", "value": "2e3e3408cbbaebd6859d10a9af9800d226423d714db7440e1686e0a2513bfa3b54d171d1a54ec3665ab5abce322ee2f5", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "geolixin-com", "colour": "#ED806B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mauserfizko-com", "colour": "#73546B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750086, "uuid": "c19b5c73-709a-44f5-8717-26577a0730ad", "value": "T15BA2D1306FBCD656EB1C4AF3F6DA6D4D8FF850685640428AE98CFC011B4BB9F1056179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750086, "uuid": "bea3149e-5033-4ad1-9480-a59fae308e10", "value": "384:DXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5Nt5:DXKuqXS69Szi/urdMt5lBUeuhJrsRxLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764750086, "uuid": "f61467a7-a7ee-4584-a405-9da99eec5c72", "value": 22253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764750086, "uuid": "04adbbd1-be4a-49ec-8b89-ecfbc0390bd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764750086, "uuid": "c91dc870-5ac9-4864-9c43-4f183a453ea0", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b762722-d019-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764746858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746858, "uuid": "d40790a0-d87f-40ca-aece-bda65cf18b54", "comment": "Malware payload (Mirai)", "value": "1b7dd106f393d8dd43cb1c2ad979cb84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746858, "uuid": "5844479d-e898-47bf-9c55-0b83bafa0615", "comment": "Malware payload (Mirai)", "value": "f77d10c4daf106a3dcbb539f490a6085751413afcd075f38d701c268b73b5945", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746858, "uuid": "54b9fe00-620f-47ee-bb25-20b58555c322", "comment": "Malware payload (Mirai)", "value": "9d9f9b2555bc1919bba6d8d7adc18c794a848860", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746858, "uuid": "374a1eb9-a92b-4e4a-81c4-f8487d967c05", "comment": "Malware payload (Mirai)", "value": "d0bd3bc2129d3a75326492ffd873528bff03120863c0563c1832846262ee177b487b03066abecba5c05f36f21f746863", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746858, "uuid": "04131379-9bed-4bf3-9fb9-48d2b5215727", "value": "T12AE3B60E7E319F7DF7AD863507B78E246358339622E1D184E16CE9111EA038E642FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746858, "uuid": "0e98043e-db34-4913-833b-ebcff6efd7bd", "value": "3072:PVVIXBxIVjPEtKT8tx8HxYEOe4nGyzY913E7BNilv3AvYDbk:PMBxIVroyRYrnGyzYI7/ipdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746858, "uuid": "98e20002-c8be-475f-9721-7509612e6317", "value": 156560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746858, "uuid": "af9365b9-66b5-44e7-8a61-1c9314b49519", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746858, "uuid": "67de4194-5d68-44a8-b96d-90c8136d079f", "value": "Yboats.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e7514-d091-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764798268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798268, "uuid": "816a70d2-77bb-4a2a-b0b7-07cbf2443c4c", "comment": "Malware payload (Mirai)", "value": "63bb9529acc6c47a698f9372dcd2bed7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798268, "uuid": "928f40a6-8378-4a1d-92b5-7572707104c5", "comment": "Malware payload (Mirai)", "value": "f7cb757927c07b0abec0bdb8d8cb07a784d672da50b5846ffdcf598ea6f622f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798268, "uuid": "27b59861-de44-4e66-94e0-96dd9ebfa7c7", "comment": "Malware payload (Mirai)", "value": "6f4ce02e789798594eb40ebc6cf9a2203e4495e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764798268, "uuid": "764c9a30-d02f-437c-8b2e-a38a4cca3bc7", "comment": "Malware payload (Mirai)", "value": "b39dc5e397382e192e96a3d31f5a136e25bf924c40b1989f229e5499c5dbf218b48e7ea4cc72bc553cd2aef525e77be3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798268, "uuid": "4737107e-8a45-42fd-be63-441bf2cb05b7", "value": "T168839E37E4255E54C19189B034F58E391F13A2C882973EBB5AE5C6B86097D9CF601FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798268, "uuid": "d30faf38-3273-40f6-8161-5214cbfe5dc7", "value": "1536:0agENhFLMgqNw6EWOcrKCTp37SK7riCOMImF7MRR:0ebLl56DOcOC5p7riqJARR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764798268, "uuid": "d3b68f61-e6d8-49ab-8124-b561c1dbf1a8", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764798268, "uuid": "58583e4f-08df-4c2d-b672-d52aab5ba855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764798268, "uuid": "3c48a412-d18b-479f-9acf-a41102ef212f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6519a2-d03a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764760981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760981, "uuid": "9f7c8af2-c35c-4468-bd85-82f3edc78cbb", "comment": "Malware payload (Mirai)", "value": "ef46d743f03b01ce595f5addc3415765", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760981, "uuid": "a543a549-7cf7-4748-b065-7008ba76f942", "comment": "Malware payload (Mirai)", "value": "f84f8b4138a358e78abb908367a1ff6f20c3b256939ff7e9daeeebc332064992", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760981, "uuid": "05597db9-58c9-4198-bfb3-f02f258d7501", "comment": "Malware payload (Mirai)", "value": "b2508f4f68e7b75be48d5552b47b9a17b3b3ba78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764760981, "uuid": "91e41eaa-069b-40cf-8b75-21287d3f3f6b", "comment": "Malware payload (Mirai)", "value": "bdc7ac68fcd0a14b566661daa5f61b54788302308c75867aaa1fdf8d1dcbbec7427020ad7407391372fc98a6aea45f60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760981, "uuid": "014ce1dd-91ea-46ea-8baa-3e37f96082b0", "value": "T1C5230169D6994DF7D9E90C39BB7B6006FA8DE42066FE3330B281C6A8A5C11164970D33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760981, "uuid": "a96e68f6-17e3-4b3f-a002-6e5095e2da86", "value": "768:sNoN4ZITU42HG7GZZPDgytRqCauLNrhtoj2gvEwdvYJHUYFZi99A0xkyHn956l2P:cZITUNH6Ggypzprh4bv7YJH1s/uyHDEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764760981, "uuid": "80277118-7dc6-40ba-be36-2abc9f7a0515", "value": 48700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764760981, "uuid": "86537bca-74d2-468f-bae6-99350b06684f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764760981, "uuid": "4cf7ccb1-93f3-4735-b552-ae4d2c9f6a58", "value": "Yboats.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5540c8b-d018-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764746579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746579, "uuid": "a3684444-6a56-464d-87eb-b56b477eff7a", "comment": "Malware payload (RemcosRAT)", "value": "94f5d4b1b65a004fc88c16e38831e406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "playercollectionpros-duckdns-org", "colour": "#9EC171", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746579, "uuid": "ea66401a-7917-493a-b0c7-77788b70059a", "comment": "Malware payload (RemcosRAT)", "value": "f85de2f8aaf57557a193873d64723149fe38314d737a86b7951ade3459242513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "playercollectionpros-duckdns-org", "colour": "#9EC171", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746579, "uuid": "0f1fd49c-9ebd-455e-9f0c-bc12394517b0", "comment": "Malware payload (RemcosRAT)", "value": "e39022bc97d7558d58c659e22a8320987e5e9ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "playercollectionpros-duckdns-org", "colour": "#9EC171", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764746579, "uuid": "79fd5296-3ad2-4073-bd6d-fe8af8d17eeb", "comment": "Malware payload (RemcosRAT)", "value": "412926b7e37f97e90672e9608741bb34978690b5e17cbae6163c4e13b99e2bf041f34805d94efb87c51d39a4de85c7c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "playercollectionpros-duckdns-org", "colour": "#9EC171", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746579, "uuid": "15cee2d1-220e-4189-80c7-2674741bd414", "value": "T1CEB4AE01B6C2C0B6E67614300925E7F5DEBCBD2818359A3BB3EA1D57FDB41809B39762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746579, "uuid": "064dfd6c-2e14-47ca-821c-00ace643b2eb", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746579, "uuid": "52592bf7-a2dd-4640-9c7a-2216c01cf15c", "value": "12288:gdzlcGO8avt9SlI6kNBHWgLjNJaKqsPZJ4mPFN:gdzlcj86rBHW0JZNPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764746579, "uuid": "0ca66f9c-13cf-4d29-b682-5179e706a377", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764746579, "uuid": "9811ab03-2a9e-444c-8b32-71e89b2c42cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764746579, "uuid": "810a04e4-bb36-403d-8d4e-1ffd1d8fb491", "value": "f85de2f8aaf57557a193873d64723149fe38314d737a86b7951ade3459242513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5506dc47-d063-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764778549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778549, "uuid": "45fc83fb-ab50-4b27-ba93-36b5e7ce9997", "comment": "Malware payload (Vidar)", "value": "870a16d761816b9b61648ded7534fb86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778549, "uuid": "fab1adff-c9fd-4f45-92ac-884fbce71de0", "comment": "Malware payload (Vidar)", "value": "f88f894670594bf686d51dcb52d0fbc01590c0e4cf534c03a178c3e3f6c98c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778549, "uuid": "5e6d9511-b0f7-4b39-a39c-398d007c609b", "comment": "Malware payload (Vidar)", "value": "937e026456577da70229c2a5bee00fc3e284e497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764778549, "uuid": "8845fbef-d1dd-42cf-a13b-839fdf3dddf3", "comment": "Malware payload (Vidar)", "value": "11d7f5c02061b9a6bbb59c5b54fb3d1e46d8ff7e055ec30214321c5558743d607ba2a5c40c739e1fd15bfb3fb9f9744a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778549, "uuid": "80798d01-f4da-40bf-9b44-50cc98106d7f", "value": "T145E623D33EC56698E0874F3461C60758E1E2BF8881FB4F1D3BC67C076671E46AE89926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778549, "uuid": "bf64fa56-6157-4f17-84ad-53896d63e432", "value": "663db01aac141130c0fe8631c0bf50ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778549, "uuid": "a7c518d9-4dec-4064-90d2-2afe3fb09ef1", "value": "393216:tjwl689OnFvANDGY5O1n23fCScsiSQ1Qpb:tHFUDQgv0Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764778549, "uuid": "b5f1afc8-6256-4b02-a1f2-90f56c21262a", "value": 15223296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764778549, "uuid": "ef4c855a-4618-4192-96a7-9feaa928c29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764778549, "uuid": "9b8c47a2-fb2b-4bb1-a9e6-5a786187b510", "value": "MetaLab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978c43a7-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764749455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749455, "uuid": "757bacce-88ae-4d9f-8307-7c256f5292f4", "comment": "Malware payload (AgentTesla)", "value": "1bc75f8999a0be364e0b3217825e8167", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749455, "uuid": "3af94bd6-fd39-416f-87a4-d2d0b2a01d18", "comment": "Malware payload (AgentTesla)", "value": "f974f6c0d45a9ebba5c680ce828d6457374e8cf9218021c95368af2ded304a92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749455, "uuid": "587cac18-1081-4b23-b152-7a6eaf981034", "comment": "Malware payload (AgentTesla)", "value": "b68d9538a866614004da01b8c7e84a09dc3a3774", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749455, "uuid": "54a30c24-0a3a-4eef-bc9c-0da0888c940f", "comment": "Malware payload (AgentTesla)", "value": "07a1e4eab7dcedca62175776369e8c77baa3d5e612e222a9eb2dcecede65898627bf2dc6c8570823c0e02c235526ac0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749455, "uuid": "9807a10f-50d8-44c6-a2c3-eb131525493d", "value": "T16305334949C15AD73629BFC0AB803FB2CCE69134C2846B64E531CAD31697AD8CFD5973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749455, "uuid": "26e9743c-9c2d-4361-905d-723bcee0a2ec", "value": "12288:DwTcmSsl9ZDdVbjJrm959lWsQja/NGhNYIZhNNQnzcavLDExx1WeB4ttIebwSc7M:Dw39VjCLWs1/+zQzzTDCxgtt9wSc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749455, "uuid": "a5ea92ae-dd62-4c23-a29c-03fd24d89291", "value": 832161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749455, "uuid": "6126d130-c1fd-478d-9a45-d3dcb3a3457b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749455, "uuid": "2e1e138f-d0ed-4239-beb2-6737482de55a", "value": "Lotus Lines Bill Of Lading - CNSZX02081777.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56670a09-d007-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764739038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739038, "uuid": "aaf8f07f-d105-4fc4-981c-d4ca643c3544", "comment": "Malware payload (Mirai)", "value": "971fdb56849d6c075012a769ee43be00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739038, "uuid": "4f38d551-7d6e-4699-9a46-fe60ed67a5e9", "comment": "Malware payload (Mirai)", "value": "f9c8e7a8734f95d1621c7a79d2c217705e5a86a57dfe12f5f92d75e9188ffa6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739038, "uuid": "ab021282-3a78-4593-8c75-88f7266d7a2b", "comment": "Malware payload (Mirai)", "value": "863ad7dcf0835baecb6a5e0c78e802d1e5f6f6e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764739038, "uuid": "2e864af5-2ec4-4bc9-a64d-47d98522a6b5", "comment": "Malware payload (Mirai)", "value": "d0a815960670abb47e8178ad22c15c2a810bec77a2591a3508a50d112961f20aaf9f14d16d9cfbad3b677b118a727484", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739038, "uuid": "02435f0f-4128-406c-9cbb-86fcd9b7841c", "value": "T121343A23FB0C2422C492AF705D7B2BF6A339D9D25576A00961196F2D2E33BB0598377D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739038, "uuid": "58718b20-1cda-4c5a-a819-823ba3d8aca5", "value": "6144:0xVx/iO6iVfpZt1ZJ5NkZ7RhtSIRYV0K7Ui:e1t3fIRYKK7Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764739038, "uuid": "fd3ccde4-ed5a-457f-b6dc-cbf7744a3f20", "value": 245376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764739038, "uuid": "aa09a1a7-de10-4785-b88f-db6b3150e367", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764739038, "uuid": "d514e5ba-e523-48df-af2d-572e136423e7", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7537e57-d01b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764747763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747763, "uuid": "b22e81f0-6754-47c0-8cf8-9aac1af7ed40", "comment": "Malware payload", "value": "56535baad75acaaa86ac617397118373", "object_relation": "md5", "Tag": [ { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747763, "uuid": "527c26b4-1dea-4ceb-8ee7-5a1ba6ace19f", "comment": "Malware payload", "value": "fa0fe19e147cf2b79ab947955e4e4cd798a2f2e25f790ec8bfdd0308b07112d2", "object_relation": "sha256", "Tag": [ { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747763, "uuid": "2b16c142-ee1a-464f-b2ac-904dae689f16", "comment": "Malware payload", "value": "835dabe432e43dad092203f8f4ac26650a75e4cb", "object_relation": "sha1", "Tag": [ { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747763, "uuid": "e24a4a9e-6379-46e6-9f0f-0183db9b0a90", "comment": "Malware payload", "value": "47afcfd374d6a303ec14ed0ef04862284934e2e3511ffc8658c5af6e60b5515a0a2d27ed63310eeb0e96983ce890a378", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747763, "uuid": "ffef65fd-dd80-4714-be0c-39b9a3c6f858", "value": "T1F511758560D9A793D91AC9331A622484F4C522B936DCF547A54DF12228440FB0E89685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747763, "uuid": "86fc7825-4b7b-43f1-b073-10a8853089c5", "value": "12:5j4OkjoBYXCzDHlM+P1ctglI1HMSY37JMZGGFGEodPDbmHDFh4If1ICkwffa5Hry:9vB0CvPPH61WmGPNHmjFhJylHNraFBnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747763, "uuid": "cf89bf75-5acc-4bdc-aa4e-e946233316f9", "value": 1057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747763, "uuid": "36d89185-f55f-47a1-b3e2-64a84a4f35df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747763, "uuid": "a8f0a680-75f6-44a6-9e3e-38ed80b69952", "value": "755e867917d9b83658d79ca1d52eca0a02eecb288dd6fe287c03fadc67f7a5c0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcde0ac-d07e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764790164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790164, "uuid": "7871e70e-9549-4033-b4b5-c34c55049765", "comment": "Malware payload", "value": "fd853c922dc870a857c56414740e12f2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790164, "uuid": "04acc84c-775a-49f1-bd4e-a35c086dd6b0", "comment": "Malware payload", "value": "fa1998eddd638d281e38c7d855ccba5deef27d57485080333e79603b01a56312", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790164, "uuid": "e2f4c679-49c5-49b6-ae24-3294b5894818", "comment": "Malware payload", "value": "230892cbe83cde2cd90e270040d5149b3f780c7f", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764790164, "uuid": "f9629f0d-d015-4026-bb2b-32eb00407954", "comment": "Malware payload", "value": "35542eebcaca2d9e673692d7e41a4abe7d84d39807fdc1b9f0746a07c2cc987380baceb9db2da5d854ff87135650d2a0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790164, "uuid": "5939125b-2262-419a-940a-55db2292a556", "value": "T11624026DE659F85EC787E438821C16E78904E05AD2B4F12F3C8976E5B5814EB6F0C28A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790164, "uuid": "f913f77c-fb4a-4b92-9e31-347f8c6dc95f", "value": "6144:lHn6mNayNffUDmJZf49Y8SABkDScItd35QpNyk73i:lHn6CxfiOF0SpWd3erS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764790164, "uuid": "1fac1bdd-2cd7-48a1-937b-8a3534a306c9", "value": 215988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764790164, "uuid": "73c1ec13-49fd-4127-873c-917db3cab4d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764790164, "uuid": "81bdf192-8902-4a00-9a67-dbb4721166d7", "value": "Acompanhamento Nfs Pendentes.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e82c45-d002-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764736967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736967, "uuid": "8470f5bf-c1d0-4bd5-bea5-b1346e01ab34", "comment": "Malware payload (Mirai)", "value": "1f83c030fae5dcffac5245f52b68d56e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736967, "uuid": "a5759b75-7c69-496d-a3fe-644dd56991e9", "comment": "Malware payload (Mirai)", "value": "fa8c8a7a8c81c75b9a379da07b286beaca803dbbe254d8ba019d121d35f34803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736967, "uuid": "c15fde82-24b3-43f4-a27b-51d30a43d011", "comment": "Malware payload (Mirai)", "value": "71973b71a8bea9841f18ec5eda43b293638c3ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764736967, "uuid": "8deb5acb-c29b-4092-8fe3-2e99de17e0d9", "comment": "Malware payload (Mirai)", "value": "e03ab49507ccaf6cca4b78d2d4f9e26e7bf70c3f648cc4194a249db92b06588c4ac0bd4d2725bd0b7785ca8bfd6f0aff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736967, "uuid": "5a2d776f-cd72-4889-81d5-846d94023e0d", "value": "T1B9934AC7B805CEBDF80BDAB744130506F531A3925A835F36636BBD67AC361A48D23E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736967, "uuid": "61b627be-328d-4519-84e9-0a7ff0816ae4", "value": "1536:e3pXG1Q2EXMZ5yqoIwBxW8HGY20p8Sbl2ntM+al6RV3FjTrBBvZKu:YSuMryV9/HGY20VgAlAVVjou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764736967, "uuid": "eae6481a-d341-4ca5-a763-ac4b41083300", "value": 90348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764736967, "uuid": "b8fb65a7-e988-450c-8787-3f08f5f24132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764736967, "uuid": "67588020-e3c1-4e4e-8eb3-3c507a34929c", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb50237a-d054-11f0-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1764772359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772359, "uuid": "b4b0114c-2f98-4516-8d43-801960b34320", "comment": "Malware payload (XoriumStealer)", "value": "1a88149b7336622ebb280d2d5ac67314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772359, "uuid": "303ab8e7-2834-428f-9f1f-00006ef011a3", "comment": "Malware payload (XoriumStealer)", "value": "fae48fe6a0c7b167093f0f6481ff9f67bab9b023fb43a4c6265403d4e57b2bec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772359, "uuid": "969055d3-891e-4026-9a88-82c3e7a13692", "comment": "Malware payload (XoriumStealer)", "value": "c2c11022def1fb097b7d482e3e719d65ad4658dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764772359, "uuid": "2047b475-b58b-46da-887a-e963a1a82e68", "comment": "Malware payload (XoriumStealer)", "value": "302c68f4233669c82d99e2079784be13832cb5315daee5e522931c0ba81a273d429eb1bb3feea503f1287938d281cd3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772359, "uuid": "b31ca193-8fee-4878-8368-8e2a095d7626", "value": "T15425F01433FC1601E2BF8BB8E8B5A0408AB5F916ED99D74D1D8120EC1A72B86FE51777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772359, "uuid": "4c83f049-8417-4a68-9ae5-e7bc2370248b", "value": "24576:CPelkqjVnlqud+/2P+A0+lyv0PTVbUkIaMUcfXO0:yelkqXfd+/9AHly8Pv6Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764772359, "uuid": "d697b0c9-2497-492e-8a44-15708c425754", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764772359, "uuid": "f9981729-8c5e-4ccf-b3af-9b383653048b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764772359, "uuid": "89d5c770-f6b8-424d-a54f-061ac71ccc83", "value": "1a88149b7336622ebb280d2d5ac67314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce01b41-d079-11f0-a129-42010a9c0007", "comment": "Malware payload (Neshta)", "timestamp": 1764788226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788226, "uuid": "ce974f12-0f00-43f7-a4e5-45eda0297ee1", "comment": "Malware payload (Neshta)", "value": "55f9e504b16e515f588f7ac875f66723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788226, "uuid": "3be0b1a6-89f9-45fb-8728-0f0264f206de", "comment": "Malware payload (Neshta)", "value": "fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788226, "uuid": "807ca5c6-4f69-437a-87f9-30c03dfa3810", "comment": "Malware payload (Neshta)", "value": "0679d6e06010b7a065e5279edf2ddfc9cf37bcdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788226, "uuid": "b0142c49-95cb-4543-8225-313bd042b00d", "comment": "Malware payload (Neshta)", "value": "041ecece8b8b1547f0633159d78240dccfb4a1710086c2eb6022d3886921f3af6c557de5047050319dfd14b723705222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788226, "uuid": "d500d17c-1faa-464a-9eab-dd0b6e8c8bef", "value": "T17D544A46769A51F0D07285348B7747E2AB3D7D211B91C68F13D07B699E3E2C0FD2AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788226, "uuid": "6802f699-0a46-4e61-a677-76c35693afed", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788226, "uuid": "e8134e99-1337-4c0d-a908-e9cd78f70c9e", "value": "3072:sr85Cr7rauZnBzNuy5pCkTZcpPSUywOy+3GHcuRbuAs0FNmhMn+IhNd/m366W4Iu:k9r7WuHtQUZcpf+4H0YlgJfxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788226, "uuid": "8771f183-ffcb-43e1-8304-ac993d1bacf0", "value": 296792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788226, "uuid": "abb5be56-f263-4398-97c8-63fe10965c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788226, "uuid": "acfc97c9-2e5b-4b20-9227-0ea43408e375", "value": "venvlauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04aef7a-d050-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1764770595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770595, "uuid": "d52d0465-e9e6-487b-86bb-a1d46ab02d10", "comment": "Malware payload (DBatLoader)", "value": "8eef2230ccba200f77aadcc193ecd180", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770595, "uuid": "fa69a615-b328-4a90-976c-32e25f7a966a", "comment": "Malware payload (DBatLoader)", "value": "fb898bba58b74c8a8bdd06c176ab7a3acb525c8f2d6a1220a2e82c6f0c991ed7", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770595, "uuid": "1d0e7235-3f8f-47b1-94a3-17cdb7bd1c41", "comment": "Malware payload (DBatLoader)", "value": "06f3013703c3a7ea9be742612e46205fc32e1e42", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764770595, "uuid": "b2698653-371d-404a-a8d7-664915d53a76", "comment": "Malware payload (DBatLoader)", "value": "42d5c40a10ba2dbc5aad3b0e09c4f1314c28e01f9e610fc49dee3eab1326d89a918a97b901faa4c71c69eb6629192a3e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770595, "uuid": "9b18a267-be48-487c-b93e-ed2d53eeea94", "value": "T17875D066A1F08436E053CAF58C16D3896829BEB43E75A85A37DC3F5C9F362742C26173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770595, "uuid": "e8ebb14f-b483-429a-ade5-cdcd15efd29b", "value": "eb41e5567017c33839f07ebe2eb84cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770595, "uuid": "0837cac9-2592-4c7d-9be6-c95731469b0b", "value": "49152:sbiFjbPqyJGVNZqBH93OjLM3z1MZiFzZSp4V9rHIMzH:sbiRPrJb51OPMD1MZiFzZSpS9rHIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764770595, "uuid": "a0de22cd-cd9a-4261-b76a-a93810838904", "value": 1644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764770595, "uuid": "814abe08-b1af-4dc1-90e6-e0270156d1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764770595, "uuid": "0cf29af8-fae2-4bfe-9438-55e1b8b1ff6b", "value": "8eef2230ccba200f77aadcc193ecd180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6fba82-d03a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764761006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761006, "uuid": "2527eedb-33d4-4f0d-9311-07319baf0717", "comment": "Malware payload (Mirai)", "value": "22eca17be23bb1a98d61866cb7efa0e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761006, "uuid": "40b8a502-5c6c-4d12-bd8e-a204bdd7827c", "comment": "Malware payload (Mirai)", "value": "fc39e04f05933ba5269298e66a207ee44fa4b919c622eba5e8d59b949b74498f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761006, "uuid": "20f1cb03-bf91-4ca7-8863-8b47058e7f4e", "comment": "Malware payload (Mirai)", "value": "702af753bb5020310d0be7fe8292bd82e498bce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764761006, "uuid": "93899168-bd22-4ff6-be50-817dc85b3de4", "comment": "Malware payload (Mirai)", "value": "d7a933306a5c4a636d0b99538dc6ba9659db1e869d4a7f19ffa49d5f2ec9ca89e6656a792168eaa441503cf677d5095a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761006, "uuid": "b78bf10a-5238-490f-a712-4533a2cb5549", "value": "T145D32A86B8D18F11C6C526BBFA1E018E332657BCE2EFB1039D245F2427CA56B0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761006, "uuid": "708c9117-9237-4133-a64d-20d318dd33ac", "value": "3072:RTxXJ1yWq7nVbWjkCeiejPjtpECezad4N5a7h+DOF/:RTNJ1yWqTCePLHIzaeN5iV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764761006, "uuid": "717bf114-a51f-446f-aee4-63e51553eb74", "value": 136792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764761006, "uuid": "e3f2e9de-f55f-4bba-8ccf-151b650b635d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764761006, "uuid": "f81a7f29-0918-4480-8360-6490498fc3f3", "value": "Yboats.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a429b016-d04a-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764767944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767944, "uuid": "d25bbee5-a7af-424a-8cee-5863f049e7a2", "comment": "Malware payload (SalatStealer)", "value": "4673ccfd7723002365ae1abab123ef83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767944, "uuid": "a1b732f6-0fd2-42f2-90ff-3165657ec171", "comment": "Malware payload (SalatStealer)", "value": "fc8a64a067ec1cd0f8190da143758db31fd5021c402023304e1f76993d2b15b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767944, "uuid": "c5d2d7c1-3b67-4757-a22c-0d99dddec502", "comment": "Malware payload (SalatStealer)", "value": "b483129f399465df452f471838503cc30ea238b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767944, "uuid": "36d095b2-8ad4-4db9-b7b4-8874f98a36cc", "comment": "Malware payload (SalatStealer)", "value": "b80a98d84da5f09da3ac931786dd691c917ebbaefc5517436dd1739aa744d36fa6431b690e6825df4c0505088ee32070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767944, "uuid": "751737c0-8282-4532-9386-efcaf33c1bc5", "value": "T1C106231ED7E441F9E0B7E178CE434506DB75BC094761B68F17A5B8A21F332A0AE3A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767944, "uuid": "81f8911d-2f92-44ac-9af6-87c76ddee50f", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767944, "uuid": "a585ae94-3cb3-4d5c-b672-050545d6ed9e", "value": "98304:gvOemSIP3T1ZDOIUNE5YPaUD5sgAUUH90yaG:HI63T7aIP4B5sgANHyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767944, "uuid": "576335cc-d047-48d2-9ff4-e971f244f22e", "value": 3806203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767944, "uuid": "3b77d2c0-5a88-4351-8bb3-ad31dd3c71d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767944, "uuid": "0f6efd8e-5651-47d8-9fab-cf120c333e53", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4bb330-d049-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764767369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767369, "uuid": "4e440938-571d-45b6-aa70-b2f73c900bff", "comment": "Malware payload (Mirai)", "value": "882d572279eccbaaffadff3e186b516e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767369, "uuid": "de4db188-1c84-4a92-a630-1841a1b093bf", "comment": "Malware payload (Mirai)", "value": "fde0c40b8ed56a0ffff1e511f824e19bbf1d18325287b512ac278013dd717281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767369, "uuid": "941a9ce7-68f1-4ef3-99d3-0ae33d57a878", "comment": "Malware payload (Mirai)", "value": "2cc27b3eaa2072b59ee86aa91b45f4597bbac85c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764767369, "uuid": "2a5e77f3-d9ed-4813-95c5-6f59320b50ef", "comment": "Malware payload (Mirai)", "value": "0d1fd8e6a5bb771d9da2d35de6d0ef70a743a4c1b32de72528689c24cee0ee807d4b950abee6329edd493899936db575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767369, "uuid": "4f5d744e-faf1-4f7a-8112-85b9b4aeb953", "value": "T1FC93B81E6E218FADF769C73047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767369, "uuid": "8339c21b-936f-4d33-a204-235542df52f4", "value": "1536:KloXJI3TfgvWG1oqXXgLAHw3AGh6zeglH08kYf:KkJIDovH1xwLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764767369, "uuid": "5e4111f1-216a-443c-8669-8d4fd7f51e9d", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764767369, "uuid": "bd9d4fee-edbf-4096-80ad-af3420ef3de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764767369, "uuid": "b9603755-8a97-48fb-899d-25c02dc5d7a9", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d2e6aa-d07a-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764788534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788534, "uuid": "697de7a8-d5a7-46d6-bb43-a628a655347b", "comment": "Malware payload (ACRStealer)", "value": "960ad9da0c6d048617b1a610ff382adf", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788534, "uuid": "618c5e8c-15bf-4820-a7d5-e405457d5ad1", "comment": "Malware payload (ACRStealer)", "value": "fe251bb1c14b74a0832b049be399bf72f9a3a638846d9e89c614942440e221e7", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788534, "uuid": "318d229e-afe3-4f9a-8795-738fe4798b0f", "comment": "Malware payload (ACRStealer)", "value": "536d13a5cefedbddc01015d02b2decbe4e4c96c2", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788534, "uuid": "8f4566e0-b207-4475-ade6-aedbb780d298", "comment": "Malware payload (ACRStealer)", "value": "897964c02adafdd6c03ecb47e07fedae608e12c5584922ab062c449cbceb488a5f5458ef1ea3618fd3d1622fb6dc20f3", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788534, "uuid": "04db4475-55f0-41e7-ab10-7cabc6107f6b", "value": "T1A95533269AF89036D97627B045FF07F31A327D3086729E6A7284BE5E0D73258E4343B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788534, "uuid": "8f773173-a6c5-4200-af3c-21d6c765b859", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788534, "uuid": "692ffcf5-017e-45c8-ae34-b4f4c093b8bf", "value": "24576:VyqDUun9yPw4pVgFtAV3JhlpSys6pMi1sAF08yY3Ozo5xda7XufoYkhgAY:w0n9yZHg/GZSH6J1TehY3so5xdgCWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788534, "uuid": "7a303fd9-0ffe-437e-a06c-d4e652407401", "value": 1304064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788534, "uuid": "2591992d-d7f0-4785-8dc4-d0a9fe3f9665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788534, "uuid": "70334cde-2d76-422c-beb3-be16f4dff2c0", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1224223e-d070-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764784020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784020, "uuid": "cf7dcef8-045b-415e-a3ae-4671e3fd83a3", "comment": "Malware payload", "value": "e80bb732513398bc209b1697234480dc", "object_relation": "md5", "Tag": [ { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784020, "uuid": "daeb7b29-f322-4039-92e7-62cec4495ada", "comment": "Malware payload", "value": "fe6852e1a8c444e6594c6588a098a2f7dd99fb5f156d26e068efd0e02d346a4d", "object_relation": "sha256", "Tag": [ { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784020, "uuid": "4ce3eb3b-7def-4b2e-9345-f3f3a7e22f42", "comment": "Malware payload", "value": "2d2aef3a950f56c67c8792030287b7e4c272aa07", "object_relation": "sha1", "Tag": [ { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764784020, "uuid": "a096b8fb-0cfb-410a-bce3-87cfc096f36e", "comment": "Malware payload", "value": "e0f1989de3f43a454e8747116337c3f6f7a817663aedb08c7c8873f543212429619adeb51ecaddf78b406db8eb32e3c4", "object_relation": "sha3-384", "Tag": [ { "name": "cherry41", "colour": "#3F0360", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784020, "uuid": "8a218be4-d8ad-4c01-b5e0-ca6d35dab764", "value": "T116C218497D98C6E9D63F4BFC65B322D80239A346511BDB85ACCC589E3E13B211421FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784020, "uuid": "8fc7b555-ffe5-4c21-9248-62cad00b5b1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784020, "uuid": "8bb20612-666c-445f-a430-a0b4d30efdf2", "value": "384:5xysR3YvGL+214dHRjQxqm2TW4gCwL1jb+PiGkeixVjU:5wXdHdikIv1jbJvx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764784020, "uuid": "5e6f61ba-7ac6-4518-a052-469fdeb0e733", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764784020, "uuid": "5ec7c3a0-c9ca-44ca-ae20-c410a9f4fce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764784020, "uuid": "fc983367-f4dc-4420-a117-7727e1dd1565", "value": "updaters.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e4a5dc-d01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764749531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749531, "uuid": "d244c9ac-2047-4b1a-b7b6-898d1a5f4642", "comment": "Malware payload", "value": "0b275855e03780f6a231b20520a10e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749531, "uuid": "c88a667d-94c4-4590-b960-c82f6af250a6", "comment": "Malware payload", "value": "fe6b81b45bf4dfa5e8453fa326901aca15d604a30262aaaeddfb62edc9130735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749531, "uuid": "c81b3630-4e57-488d-990a-2597c1fef61b", "comment": "Malware payload", "value": "abf8e726ad334be51c113e6d3ae686ddb6cdeea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764749531, "uuid": "2753b736-f0dc-48db-8af5-ab0a675de4f8", "comment": "Malware payload", "value": "0b1ad0c9b68851bea30257ad8175d9df4ac4fba646fa19bcd4f78d1f3208821d6079c54d2a062bfe923cdde34ec75159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749531, "uuid": "0c158c19-4f88-4cfe-a4ed-31afb1ae5af2", "value": "T1A6973382F1814BEBEB0C793B3D713515C2B9AAC80B8A6015564F34DF3CF59C6A485B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749531, "uuid": "8a3cc381-efd4-4ef0-ba3e-16216140ef93", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749531, "uuid": "23d1dc98-22ce-4906-82b5-803eb3e446a4", "value": "786432:Q92hQ1eDA1qHYp1GEkBxZzP5xWxHBVs716k+zxzmkLV39xLwUWU:QeQk01qHK1qzRIZQ6zxz3xLlWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764749531, "uuid": "1c6622f3-d645-4cc9-9a15-10b15e49d617", "value": 40998598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764749531, "uuid": "99a548fe-449c-462e-b6c3-50be4fe47774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764749531, "uuid": "23d83608-0057-428f-8466-4463390ccc02", "value": "easycert_demo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4c62af-d01b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764747777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747777, "uuid": "5f76f813-2828-4844-8214-d951f2aaa86f", "comment": "Malware payload", "value": "dc0e84fd1437ca814b530c3e6a769b3b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747777, "uuid": "187d3ce1-8b8e-488a-8ce3-97e9e29e9482", "comment": "Malware payload", "value": "ff045336bbd131d659bc131fc91da0c5edd4246ffb2ee3bfdc7e670468a242eb", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747777, "uuid": "771348d6-2d44-4e6e-9549-052eac9c67d5", "comment": "Malware payload", "value": "25f3645bfb0780df3e09166ba0a5c2e7064eb34e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764747777, "uuid": "38fc121f-0758-4e9a-b257-c3c0083916f3", "comment": "Malware payload", "value": "c6d2c569a574254e860f2291e4ab95b885ade76e26b1fe5c1ab77fef52805427788f318f1ec2e4dda9ddf720dc36abda", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747777, "uuid": "4309869b-ff5e-426a-a599-4f69b1758a68", "value": "T1D973649C8DCF91F8562774558ADFCC02EBE49507263CCBA5FA5DB9902F41828F2E46E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747777, "uuid": "f7b1e3a2-e7d7-4bfb-b5ce-31d0f3b3ae16", "value": "768:NberWArvKtelWWWWuoYmGOHFj8g53Aie0Q/BzpazeoB3obIUISzqf06TkuLJyeQK:hiWWWWOgMSjSzq06ERcV/jePPCLw5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764747777, "uuid": "ff5e04a0-0979-420c-8cf6-8467ff8233ea", "value": 76069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764747777, "uuid": "22077700-9a5b-4c84-a2ed-f46022d45d3d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764747777, "uuid": "068e3f9c-4536-4c1a-8804-654649535c40", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90389a39-d079-11f0-a129-42010a9c0007", "comment": "Malware payload (Neshta)", "timestamp": 1764788097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788097, "uuid": "8a0f62c7-f134-468c-9e25-de7060016425", "comment": "Malware payload (Neshta)", "value": "c3c4c1120ca77c00b4e867b3283ccfca", "object_relation": "md5", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788097, "uuid": "a9154016-8457-4205-bf46-e199225335ec", "comment": "Malware payload (Neshta)", "value": "ffb3fa787a7cec0b375345f384c82b5ad8e3d8f55aeb70feae1f5ee986856177", "object_relation": "sha256", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788097, "uuid": "c8c9edcb-ac3a-4f0b-937a-f91220ee013b", "comment": "Malware payload (Neshta)", "value": "4c5719c4c39bba904b22035243c2b11742804001", "object_relation": "sha1", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764788097, "uuid": "d430d4da-ae87-4b96-bee7-eb4477befdbb", "comment": "Malware payload (Neshta)", "value": "668c4434844527d8525eeef130e27bdba4feefc240eb68371c0cee5a375c6ad900d46aa24f41820ccaceab6c52cec081", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "globalsnn3-new-cc", "colour": "#B24257", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788097, "uuid": "83dce949-b078-476b-b35f-78f6ba7f70ed", "value": "T11F673348D22F52D4E92BEE7464CB672BFF94E14D7E3893570A583A001E527DD1B82B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788097, "uuid": "caae42d3-c1b6-482b-a441-eb9f4352b916", "value": "786432:aHruNMtzSu0tO4eVI5dOnTTRxS+QIGZF5d++NQ2:aLAmmJtpYTnTTT12LNNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764788097, "uuid": "08891356-5b72-453f-9746-e46d091b1807", "value": 32654706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764788097, "uuid": "b13e3b43-33ce-433b-ba68-85ea5ea70472", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764788097, "uuid": "3c7a2349-1f46-44b7-8123-e0b0c6415c9d", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }