{ "Event": { "published": true, "date": "2025-11-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-15", "timestamp": 1763251381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4c54643b-bc52-4b32-8c29-70fe4001bc13", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dbe7d7-c240-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763224073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224073, "uuid": "8698293a-6211-49e5-92a9-d1e9a79c3aad", "comment": "Malware payload (Vidar)", "value": "cc923f6664528f350e25a36490c6b629", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224073, "uuid": "29f09274-91a8-4fb0-8e9b-995c477076c4", "comment": "Malware payload (Vidar)", "value": "017e65f9f248cdb43e5af0c515839f8d850b578f98f2fc3a04b9b72dc9f4099a", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224073, "uuid": "d5a0824c-71ff-473e-abcf-7d02fc8b329b", "comment": "Malware payload (Vidar)", "value": "bc7ea5dfa9adb1a9d54ebf8191cd93e91c0af3ad", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224073, "uuid": "5b383045-f399-44cf-b362-f7626704746c", "comment": "Malware payload (Vidar)", "value": "908912d07e55f365d358fc69a633c0f644ca95d07a1ed8404a440813c467519253729ccba7808e2fa9a900a27ed03c19", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224073, "uuid": "f5fb72cd-27e7-4b46-8604-443b18a91622", "value": "T169F55B46ADD04D76E05AE239E8E241767B70BC091B3663D33E607FBA1E33AC05972764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224073, "uuid": "94820d89-3c30-44c3-9fa8-e19998160140", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224073, "uuid": "9de34847-3698-4e23-9b3c-4ed2b0612745", "value": "49152:mabaJfDPk1aELB9Og0ENgazjrrXw4G3tP0:mFPkqbEy0g90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763224073, "uuid": "56b62541-ce4d-49c1-ac78-9edb73563f0e", "value": 3604992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763224073, "uuid": "80cecb6c-bc4e-4c29-b17f-c93b3f8a1b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224073, "uuid": "6b220c65-5b70-4d46-89f1-3bfa12401167", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce521f64-c207-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1763199923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199923, "uuid": "6589ddff-8819-4087-900c-bf113214cb6e", "comment": "Malware payload (MaskGramStealer)", "value": "62517e7137701abdc217e2d56bb087be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199923, "uuid": "01b66b81-34d7-4823-9c83-362be9e26213", "comment": "Malware payload (MaskGramStealer)", "value": "023443058ca648137b45f851c6c164718a4d21f506f50c652698923d0bad9a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199923, "uuid": "b5a745a7-6f0e-4710-b8a6-3037c71883a4", "comment": "Malware payload (MaskGramStealer)", "value": "19f3be5235be5670e8e3cbb7254c14bc4e86a236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199923, "uuid": "ec38b190-92c8-4c61-ba44-0b036a614bb1", "comment": "Malware payload (MaskGramStealer)", "value": "4f404b8014ea0572cef49b55c8402962cea104c0a8cd08c81731c56e24632fab055cc702876c5673d295fb0da749af38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199923, "uuid": "64d2f9be-219c-46ff-bf6a-168afa688aff", "value": "T15104C065592C845EFA769BBCD0CFF692D0B23138EFD8B16A6D0E733117092706E1E624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199923, "uuid": "549c5c59-92f1-48cf-8035-c34e8b119b44", "value": "0b8fc27747798374128089e16d9229e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199923, "uuid": "66478ef8-0447-4492-ac90-4d0ef2abdb46", "value": "3072:7kPO5ReRj5DxazVagTQikj/8qjPTjqGZg+krg2Ks/GkrwN+7215115xhHwiEZYO/:7kmYPTjqGZg+krg2Ks/GkrwN+7215117", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763199923, "uuid": "ddbbc64b-22cc-40da-bf14-66804b178613", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763199923, "uuid": "f96e38ce-39ac-41d7-9f31-d741446cff53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199923, "uuid": "6046fedd-05ca-4e60-9ebf-ad36d165eeb4", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5600ede-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200713, "uuid": "a4a32bd7-fd8b-49ba-a23b-521cd1e65a4d", "comment": "Malware payload (Mirai)", "value": "0f6caf9e45006ec3805b9013322f91b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200713, "uuid": "c556a96f-6b15-411c-bb6c-ba5d9e6b7180", "comment": "Malware payload (Mirai)", "value": "02438a83ff2a5aa236601f915d58d8d0d60bf28d1f6bc97e691117ff008bb86e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200713, "uuid": "f78e6909-29c9-42a7-aea5-24749e716e75", "comment": "Malware payload (Mirai)", "value": "0bf2532343fcec2dd07bd52cb8b79c29054f5910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200713, "uuid": "e90c25cc-99f8-485f-b561-7aed0c0c0d5e", "comment": "Malware payload (Mirai)", "value": "372c824aac7e6afcbaf4413c2d306e02325fc59126048a783c3dae6d7675a78dceb4628a1c1f05d2c9fa7e38850ea004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200713, "uuid": "5d939bf0-79f0-43a7-8910-ee54510882ad", "value": "T169731945B8428A53C6E8237ABD2E11CD3325736CE1DE3216DD252F5637CAA2F0D37692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200713, "uuid": "cc71d25f-7db8-46c7-9f4b-142ea63dae25", "value": "1536:uX2+4/cCngHSR9AZWSrlT2IlEZ8UOY5QUgfZ75hgF7YzF54uV:3dbgyR9AZWSrt2ICGY5Qtx1uF7YzF54S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200713, "uuid": "3c586b47-db14-4884-b011-fc3eb185247d", "value": 74728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200713, "uuid": "14ba513c-5c66-4e16-9c95-4558bda9911f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200713, "uuid": "02991724-9a19-40f6-8b5f-78ff399cadab", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2217868-c1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763192117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192117, "uuid": "ebf12d38-9e7e-4bcb-b5a3-6ae17ea88be9", "comment": "Malware payload (Mirai)", "value": "ff9f171a78d936451d53f5cd9f8d8d50", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192117, "uuid": "d8678903-d0eb-491a-b364-f935a6ac948a", "comment": "Malware payload (Mirai)", "value": "027634fc4a6cfb7aa05f59966c5285314f37aafb985d27b116863988ecf0adef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192117, "uuid": "ed591144-e2c4-4045-b87a-b55a30c76792", "comment": "Malware payload (Mirai)", "value": "31e64948ab58612378d5e812a461c4b634f7fa07", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192117, "uuid": "ec533c78-b626-45f4-95f2-57575f5bd46a", "comment": "Malware payload (Mirai)", "value": "8be87a8e5c9876ae4cd038a48a151717bf86a06001e5b41bb5507aec4428523d0698117e3fb8f88a77c181ac5ce7c98b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192117, "uuid": "0b626a1b-3965-4dda-82eb-b8262962db6d", "value": "T17C6170F72388063B5CB6C9D672B90444B19481AB14CE6F73ABDC38B61D8DECC7C42662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192117, "uuid": "3c347cb5-42b5-466c-988b-590851770237", "value": "24:xjlStMXSsBbuSP+NSU5lASynYSGTUSTnTGxJSpA/S2jMSlnlNIpJS8xMtSgduS7e:/bo1Mam+TQJTGpYCNGzBgJVFjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763192117, "uuid": "f6b79528-b8f1-4991-9800-53e8a8092ae8", "value": 3362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763192117, "uuid": "a81db64c-535a-4cb5-8780-97cf3ebb3049", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192117, "uuid": "c79581da-5f9f-4874-8dca-ee8d2cfbad23", "value": "2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c039bf4-c1fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763194577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763194577, "uuid": "e32abd7e-6b4d-4a57-b644-7e8ae00676b2", "comment": "Malware payload", "value": "6eaafbf8befb414545b83748e7c9e03a", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763194577, "uuid": "8dd00397-146d-456c-8b48-a84201e5694e", "comment": "Malware payload", "value": "033dcb22a727ab8ddcae53eafedf19736a768267c50113108e2e9cb6c8b91848", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763194577, "uuid": "ae5618a4-f50f-45b6-bdd9-60146b40ccc5", "comment": "Malware payload", "value": "cac5546e85dadc28ffac9c252c67cec4ff94fe27", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763194577, "uuid": "8e9e66ce-add9-4686-b521-b5a4cce48d18", "comment": "Malware payload", "value": "2aae53505c6a48d9bdbe5a5819932cbcc080b4c2967b2020f4d587df6bfaa526a36ffd3a2f15b9748e84d479355b18ce", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763194577, "uuid": "1fa1e8a2-3323-4dbd-bf03-2469d4e19246", "value": "T1C401D6BDA1A88A5205B5C5C7B2F14546C490908BA2EE57E6F38E09276F28CDE3C5320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763194577, "uuid": "e063dc74-ca6a-4841-8ff9-0f60514308bd", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+GSjRBk4DClk4DoBjZhG+E6:FH8j/wWi2jzCmIFSzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763194577, "uuid": "b1e344f1-bd36-4151-b1a3-1df743f7e75f", "value": 739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763194577, "uuid": "422eba92-a7f8-463b-b782-0e9f51870095", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763194577, "uuid": "f7a4d23a-8637-4e31-9311-f1cff57322fc", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206afea3-c259-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763234850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234850, "uuid": "a7b1b3b9-6353-4e3c-b241-400cd0d97a82", "comment": "Malware payload (Mirai)", "value": "c96d3cab290a0878a890371de9cdb491", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234850, "uuid": "47109d4d-6ef5-483f-ad4d-9c03ff7bd123", "comment": "Malware payload (Mirai)", "value": "03796d3a2d2ab7dbd786648e5d972f5a8456bb61cc635f34797dd7d63d95126b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234850, "uuid": "7b5d89f2-5d5c-44e0-9a45-494ad0800146", "comment": "Malware payload (Mirai)", "value": "5c385bb48751fcca348c3eab847d55bea6e3cb34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234850, "uuid": "abff40fc-a8cf-4ee9-ba89-533653e99437", "comment": "Malware payload (Mirai)", "value": "5086aa3284c10478a796641b14260d7378e545c28f997972735da7aff40d09424e219fd518644159372e5962b07384b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234850, "uuid": "b76ab46e-65c5-42c0-bc6d-a5d0a30ba295", "value": "T10953024E50796CB7DD576AF30E4A5344AF71307A510232AB09B5FB9F4EF8810DA32710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234850, "uuid": "cd16aab2-4a15-42c7-a419-fb1b4cb44067", "value": "1536:Ks6YShhOL7ooEvVFr+1+N0nUDSxzjx7h6D8CbkKbOHNPUBfw3:x6YUOAo0VFlKUQzjz6QCbkKqHxUm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763234850, "uuid": "473ed01e-97f7-4bd7-a46f-cce95bf88871", "value": 66072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763234850, "uuid": "9b6fd370-5115-41c3-bf73-6066121c36b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234850, "uuid": "4ca6177e-4b26-4b81-8551-f643fa5a2f45", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4122e1f-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200711, "uuid": "5b7ec79c-313c-44f8-83fd-867a3f19ff6f", "comment": "Malware payload (Mirai)", "value": "8866c45aa12712b46c91ebab60f7b8db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200711, "uuid": "b3fab8bf-078a-410d-9d62-0d70a15518b7", "comment": "Malware payload (Mirai)", "value": "053c18aa1080552dcbe9357e6adf84289e6d89fb55e2bd2d7cb1066551ca2576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200711, "uuid": "21daa01c-1dcf-43fa-a0c9-ad0219125ed8", "comment": "Malware payload (Mirai)", "value": "b5c06f3179eb6d599b4af38a55d38a2ff4bce0a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200711, "uuid": "a58c4485-34ab-4820-b458-33f21f107fd2", "comment": "Malware payload (Mirai)", "value": "60cabbe0f062186e27828a20dedc468e0b40b9759f78d923761587f7946b47696759d49441272356021df15c6725f233", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200711, "uuid": "77249a56-7a8d-4863-b817-f6222deef963", "value": "T1B393098678415A26C5D427BEFD2E01CD33272FB8E2DE32169D156F207BCA91E0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200711, "uuid": "47c06673-4e6e-4f29-a32e-1f5a27559f51", "value": "1536:g2nSjzlOMEbN0GZtQnEg4UExACYDweyvHK/PkIL/ajyBnmyu4hJJZDYExDCOf7y1:7HwE8EkZzra2BmA/OQTBSYhiKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200711, "uuid": "2c07d694-16bb-40da-83b2-48334391b928", "value": 91572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200711, "uuid": "42729677-0470-42e7-a0d3-2cb90ec1aab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200711, "uuid": "ad3cbd34-6303-4016-9aab-d6e4fbabb7b5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11040da6-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230529, "uuid": "16151c66-c075-4ec9-8da6-f03c6777a401", "comment": "Malware payload", "value": "07ec3ac0b06ed78669f339b527bf271b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230529, "uuid": "798f4e21-9026-4981-ae9c-54e8385ea035", "comment": "Malware payload", "value": "054f2a8e8af110bf048b1b88dfb1edd18cba9c373b67d424b76ff8b1e517a811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230529, "uuid": "88b174a9-784c-4450-a297-b7d84f286a04", "comment": "Malware payload", "value": "ddb47ecbba776cad5d24c63fd9199ea863134240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230529, "uuid": "ad45e1f1-f63a-49f9-8619-17b2d049c95e", "comment": "Malware payload", "value": "cade9d1f83b95e513fa58c07cd321f96d035b2ddfa87f024dd105d478be0e860c268d1a409df5f5c9894cf070fc0c67e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230529, "uuid": "f3a94740-ecdc-4f86-a436-733ba0b0527a", "value": "T174A5BE5AA7B410F8D96BC13CC9734517EAF2B4561360A7CF07A086A61F237E09E3E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230529, "uuid": "2e8e81a5-00dd-425e-b687-04825264ab0f", "value": "b5d61f5401f957a1fa7397e1c31a7f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230529, "uuid": "dd186509-f316-466d-9eef-af2f0ff3a322", "value": "24576:BMWbfdvNJ0yMTA7uivx7jVy/AUayXLjakhdejwfG5JLCgxZ6FMkCCgx+l6IONflX:6WxvNoTEDx7jVy/AUayXSSsHjtvDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230529, "uuid": "716bfd4a-d071-429e-b53a-f51a6f162797", "value": 2063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230529, "uuid": "e3cfd5bd-e4e3-4fdb-8852-0c40afda60fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230529, "uuid": "3bb8ac00-2c33-453a-8fe3-e3aefdd91076", "value": "im0mo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c138558-c1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763186068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186068, "uuid": "bc0011ec-1e48-4eab-a80e-0b685bf6711f", "comment": "Malware payload (Mirai)", "value": "ad31e2045f532b072080c995aa9920a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186068, "uuid": "89f20496-73d6-4967-9a26-9380d7cecf78", "comment": "Malware payload (Mirai)", "value": "05dc2fa3b9813e6d4840d60de74de7d951a85afc69961f5ec2f081a2031396bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186068, "uuid": "8f4095d5-2e71-4675-a30f-9356a8bb735d", "comment": "Malware payload (Mirai)", "value": "46052c9d03c10750316480779a75b9167d7e38e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186068, "uuid": "8962df1b-719f-403f-846a-6941404f6a35", "comment": "Malware payload (Mirai)", "value": "e8de9cc9f4c8be8150eb34a0c1749297cee1cb17d5b2a7e8671941b1d199f1d396948776dd1685e51d18c543165079a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186068, "uuid": "ab0a9a67-fe5f-4517-8e19-61074b2ff60d", "value": "T1FA130267EFA906D3D26FD33B8E8FB59A4B38B41549C70263F2C0427B0994F8D542458A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186068, "uuid": "b111cb96-8c4e-4e50-982c-18804009133b", "value": "768:Hf8+nbR5n2q1PddtJN8uFeDU1PQ6a8bmZgipQfgVom1w1XxnhAr2nbcuyD7UHQRN:/Dbn3FxNhUU1PtbmZgipQfphAr2nouy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763186068, "uuid": "0052971b-a059-4813-9a9d-6632121ed128", "value": 43372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763186068, "uuid": "f9ac65f5-5788-4a9b-b109-09b1afea2640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186068, "uuid": "cb06b806-77e1-43c9-b352-db04cb46f26f", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955b3d60-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240629, "uuid": "112ad5c6-3ecc-4c1d-87b0-fe6c4108bbe1", "comment": "Malware payload (Mirai)", "value": "046a32e6eb83e1495fedba295316492b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240629, "uuid": "88b168c3-1146-4603-b64d-b7a2ab1bd6c4", "comment": "Malware payload (Mirai)", "value": "05f25db9ffa5a50e156891ed80d282892f08b734b457f2c1abc3333f51f30910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240629, "uuid": "3610efb5-898b-4f51-a9e2-fa21b10494e7", "comment": "Malware payload (Mirai)", "value": "dc0684b67ae04eeb0cf8519e194e92c8052f6fc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240629, "uuid": "44ccc645-856d-4c10-8cd2-2b2cc18166e6", "comment": "Malware payload (Mirai)", "value": "7949ece39caaecb918a16397858a51d10eb9f31eff2765b9ba2f194a5bc0db083ec3a2a07946319e7c055bcdb5175260", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240629, "uuid": "ed8de1ae-7f82-4bb0-8322-dc5bb0ed8abb", "value": "T15DA2E17221786E31CA348C7BDD258DC5A36B277CD2E631374784234474DE1A724B6B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240629, "uuid": "1d40f5e2-35b9-48c2-bdb6-2fbbc48c38ed", "value": "384:ZOakvOM1wQsckXWffE8AQMIsLmRtIgYTEzFYRnc/BnFmfhymdGUop5hFQb:ZOa+v1fQ8dhRtATEzF2nc/Bncfs3Uozm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240629, "uuid": "3e7fc186-6410-468c-a487-d470dc83bc40", "value": 22248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240629, "uuid": "d72a5c32-c85c-4f3f-8e27-1b33b6684fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240629, "uuid": "5167b7a1-ed8a-4a63-8791-e93f5a1cdaef", "value": "brichs.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a0c61b-c1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763187639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187639, "uuid": "62edc92c-f0f8-4e6e-8fe8-fee4123f9d7f", "comment": "Malware payload (Mirai)", "value": "9bfec03127c59771bad3e16d5185aac9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187639, "uuid": "a38bf2ec-9cbe-46e7-a659-fb3e111d007f", "comment": "Malware payload (Mirai)", "value": "0684cb0bf644ac9fa398d89cef2b82b3e413b7b3718f078f68ae488d69d5dd3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187639, "uuid": "5fbaab4e-43b2-4942-96f9-bbe448cec80c", "comment": "Malware payload (Mirai)", "value": "42d3624d0346085c9441c018cf7137ccdb795999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187639, "uuid": "46f3e09a-9fdf-49c7-a943-cde2eadd74de", "comment": "Malware payload (Mirai)", "value": "2b6e2d01aca94a956152b138fd6a293b76adb9900c76c539c3207f49445c6ea2483a851e838ca25264c453b18f6d3ac4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187639, "uuid": "7635ddfb-0cda-4d48-9ea1-7361285d6a18", "value": "T175731991F8C28B7BC6E013BAA66E668E336163E1E2CF3127DD259B1137C510B4D67E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187639, "uuid": "93f03944-42ea-484d-8ab0-527e43f53f70", "value": "1536:2dfHXNAPe9HKTsIHndUOUSyTj7KBasu0UvD2:25HXNAPcZKa+UL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763187639, "uuid": "1c59e2ea-c753-41a8-a57e-c35e7df55181", "value": 75200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763187639, "uuid": "b19d96b7-52e0-42bc-a534-13ce02826589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187639, "uuid": "eb0adcf3-e12c-4c2e-9bfc-9574365dbafd", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad98548-c237-11f0-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1763220210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220210, "uuid": "af5ca263-62e3-4c78-b45b-521ab95664f3", "comment": "Malware payload (PureCrypter)", "value": "d9657b84bee4b3dcfd277e8c60c39bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220210, "uuid": "8228fabe-06b7-42f8-8267-2c5faa97aa36", "comment": "Malware payload (PureCrypter)", "value": "0769bc2606709ae776d7a821a3783c576884f0f2919bce4ed7f5464611d65572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220210, "uuid": "09892ec0-e730-407a-a938-dc733e3bb888", "comment": "Malware payload (PureCrypter)", "value": "3699fd1389059354b9775f54055bb99ba76e931d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220210, "uuid": "3977ef96-74ac-47f8-a125-520fe7ac3771", "comment": "Malware payload (PureCrypter)", "value": "11e5ef190cfba9fbcf13ef22cd65543ca342de508a02f12ad3ea77c8258047477e96bc2434051e7b34613ce5193afdd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220210, "uuid": "87c26cbf-89e8-4e03-9256-433628212f96", "value": "T1F8A63321A7C27E9AE08887349278D70B704593BFE18D5C64E58D95BB8F9FAC43F06C91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220210, "uuid": "92df944f-32ec-4f64-8fb6-1167a8e3d100", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220210, "uuid": "0eca859c-24b2-46db-b438-eb86d33ec37a", "value": "196608:451QJGkJQTDuH9Qs0tEocVh6VQ4CcBCnFum7dOyUuE:45qJLJL6EXh6VtsFum78uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220210, "uuid": "c53abdce-46c3-496b-9379-bdd158fb7394", "value": 10169856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220210, "uuid": "9be8f233-bc22-462a-98cd-5db9d6655dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220210, "uuid": "edd13af0-0ce0-4517-9286-0ce514ffe5e2", "value": "Installer_v5612_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc36e021-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240748, "uuid": "8ee54204-5c31-4ceb-a048-ba0f67cfe5c7", "comment": "Malware payload (Mirai)", "value": "777fa76d255814e4cf45f726c657e079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240748, "uuid": "4c673ba8-9379-4aff-96cd-f73e78866a02", "comment": "Malware payload (Mirai)", "value": "0a45886c0756818d85d41831174658a62e653158758af3b7850c7038afa6810f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240748, "uuid": "743977d7-5b0d-4c59-adda-796dcc3289a0", "comment": "Malware payload (Mirai)", "value": "acd5ea5b8ec3a259a80714c388bd632383b0f7ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240748, "uuid": "df84f392-69ea-41fc-9eae-d2c38b0426b5", "comment": "Malware payload (Mirai)", "value": "3b0eef21ce27b8bbfa8df84a63daca177ef0c0c2b83ca9bc4904efdcefea8688ba8dba0b74007380de788fc1a759048d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240748, "uuid": "af60c6e1-ad0a-4981-a745-12c180ab6c9b", "value": "T13163F955F8818E25C5D5037EF92D118E331227E9E2DFB222AE109F603BC692B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240748, "uuid": "ad3a2557-4b91-467f-a706-50aff62cf37e", "value": "1536:atn1WnqqK3skVxgszIh1+Ec+6Cu/5jgcjIAigD06DuEKT:Fqq4sqgeW0MqD06DuEKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240748, "uuid": "82ae7f16-3a40-4536-bb8d-b69bc2596542", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240748, "uuid": "cf75c0d2-cc84-4c57-ae09-d0bfe8743c3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240748, "uuid": "5d406174-0255-4bb8-9169-9cf28b10aa04", "value": "brichs.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f82488-c224-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763212094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212094, "uuid": "d40fcbff-65e2-4299-a2e1-ff0beff3d003", "comment": "Malware payload (Mirai)", "value": "7ef0d62b31a635420e2c4b6aecbee122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212094, "uuid": "95c9c885-65f0-42f3-8d67-bb78e97951cb", "comment": "Malware payload (Mirai)", "value": "0b4033d26749de394c3968c2fd86c99e0b9371459533baaed3b29bbd648aad0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212094, "uuid": "b715c35a-9a84-4760-a1c5-af35f0bf821a", "comment": "Malware payload (Mirai)", "value": "76350a4a8eb6e600997c521e059bad59b2a3ea7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212094, "uuid": "0973a78a-4af3-4d7f-8815-5ed49583e648", "comment": "Malware payload (Mirai)", "value": "aa2c9f8ba0f878fcd8d978460df4bd423bba3bc6dd5bcd570c954d0c47095b341b3a5983dc76a49ba1d5941b9e08e3e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212094, "uuid": "98de46df-7f5a-4e98-9bdd-0519ab9e5f8a", "value": "T118C3F185BB6369D1C1A342BDA4C00AC387912E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212094, "uuid": "f56a35f1-b325-4635-bf6f-e9195163a611", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnm:0OCDjXG9qTWywxlxTnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763212094, "uuid": "54a40acb-b839-4f95-94b6-b50bbe617556", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763212094, "uuid": "a0261934-8c54-49a7-b97b-c19682a02d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212094, "uuid": "9025fe1e-4096-4766-97c3-abbf4f4045fb", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78bb6cc-c222-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763211561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211561, "uuid": "4d940294-7b46-47d3-89f8-2542757dab35", "comment": "Malware payload (Stealc)", "value": "20daa2b56acc915bc90dcaa868bfa31b", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211561, "uuid": "420abe69-e7c4-46e6-87bd-3c56be1c7a3b", "comment": "Malware payload (Stealc)", "value": "0b586f16ba08538d8779a08b19004993f2bad1aa936ef2e75899c24133309357", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211561, "uuid": "bca932c9-b376-4901-af7c-149a12821598", "comment": "Malware payload (Stealc)", "value": "ac74248163d757ee4da551f8cc5ebeda7745a97e", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211561, "uuid": "45950fe4-2c31-4570-80cb-c1c6b36ce0aa", "comment": "Malware payload (Stealc)", "value": "4f0bb879d96d1c0a60e6cb87fc95c2983d748b283106e65600127a74ca102ae8a5bf5b90711f5ba8a1337105619189d5", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211561, "uuid": "914f8e72-c323-41d2-af90-8b193d929c11", "value": "T121C49E06B640D4B6E0770574CD74AB249BFEBC700AA15ACB73C00EAA5E716C1EF26B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211561, "uuid": "b5db4b0b-598c-412e-aebf-7d552981bd25", "value": "142742dbf9c32803f23e9bf4191577a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211561, "uuid": "1d8d0c03-edba-4797-bfff-348fb6c28c3b", "value": "12288:veEcWN9hWQ/vNJR/4x639f4ov3YZtF15kjHP8AT:veEcQhWQ3Rf14k3t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763211561, "uuid": "3f6c13de-bc13-4895-bcaa-c2c07aec4d9e", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763211561, "uuid": "3b25b4ed-dc1e-4320-9238-641cdb3e0fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211561, "uuid": "ffabaccf-1a59-4d66-bda8-42a105f07247", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4518cc29-c1c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763170916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763170916, "uuid": "605eba03-064e-4c2b-a97e-0d070847766d", "comment": "Malware payload (Mirai)", "value": "7514545db6003a96cf1451816458365b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763170916, "uuid": "08c05e9f-8235-4700-9542-8e64e7a6140d", "comment": "Malware payload (Mirai)", "value": "0b92b5b5cc75b75530bb73ba67b46be9b99b2f0cb9aee486020f0c784bff1626", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763170916, "uuid": "897451b9-b0b6-4ed6-85e7-420e694bb8ff", "comment": "Malware payload (Mirai)", "value": "4babdce756803b02ad847db093d145e554df0ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763170916, "uuid": "a33245f3-2ef9-4ff7-b73e-7df41b525d43", "comment": "Malware payload (Mirai)", "value": "af7ab2789c1f9863a149efe0a10e183a2e95d64cc9c96dd22b5254f3b49c8880863b393dbf7eb0ece6516acc3d1659cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763170916, "uuid": "fe4ec5ba-6844-44e2-a494-5fd8d5df068f", "value": "T14923F13FC4796F9EC2FC433A00DB540D6980621D661C54FB6F58A4666662F377226D23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763170916, "uuid": "3a2e06d4-0deb-444c-86f7-999d0bb94b29", "value": "768:Auv5rDJbIG8yFoK8FUJM5GSbqrfR8PJTcQMI79Bch+UDelHaBlvAlpdenbcuyD7e:Xv5rDJT5OSM5pb6tyghHBloYnouy8GyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763170916, "uuid": "0861c233-3a0b-4c46-a498-8a7818def4f0", "value": 48052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763170916, "uuid": "38387eac-cfb8-4bcb-ae57-a10563777a93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763170916, "uuid": "e7a3e6c0-f54e-43d8-9323-17339c3c1c35", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e196f402-c1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763172038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763172038, "uuid": "77bfc11c-ffec-4795-9c92-2b4d53c986e9", "comment": "Malware payload (Mirai)", "value": "3b13c9f59222636f03274889f1e3cac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763172038, "uuid": "0d49a0f1-3c50-45e6-a4de-770cc54fb9b7", "comment": "Malware payload (Mirai)", "value": "0bee4aa42da449883719a249c427d53946ff6f68d71b51ab35dbdedf5dcfb94b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763172038, "uuid": "b97a0d43-0ad0-4027-bce1-0693ce0079c1", "comment": "Malware payload (Mirai)", "value": "ba06638c86d75ec79cd5a4c0896a50d820c86d8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763172038, "uuid": "95f93222-74c6-413b-bf7c-71ae8aa5e99e", "comment": "Malware payload (Mirai)", "value": "5a3bb6471fb213fca6c685c3fee3ead54eb7fd6bd2ebf3cc15cdf45a2d98134b6f5ed79b29918990cad8ec13e6aa0730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763172038, "uuid": "eefec100-8919-4ba8-8218-d51967bd3074", "value": "T1B3634BC9F983D4B6E857093010BBBF639DB3DABE2168DA43C3A855369D12502F416E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763172038, "uuid": "05720638-d07d-4d75-b970-b32d5e187ac7", "value": "1536:ltWizyApqj4PfWjF7lOvZOWsIyq3XkZSY9:ltFyA0j4HWBJOvwfIyqs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763172038, "uuid": "deca4443-c3d6-4792-b0d8-6cc0c95bf9f8", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763172038, "uuid": "2fe91383-bc5e-4116-ba17-611c1d239fe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763172038, "uuid": "62bf41b7-6853-424f-9904-484a89115684", "value": "camp.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b6ac07-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763230860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230860, "uuid": "b6d976f0-1ba5-44fc-9b6a-9f89a321fbd1", "comment": "Malware payload (Mirai)", "value": "db76a5e19c8953ff9d5c5e3c40b66af7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230860, "uuid": "6ec8aefb-19a8-4fe3-9627-748179211392", "comment": "Malware payload (Mirai)", "value": "0bf98ffdc8b98e0b802b1832522485573d8dacc20a199996c96f7724253fe884", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230860, "uuid": "7f4b3263-c6ad-4f8a-b018-3ee92ea996fb", "comment": "Malware payload (Mirai)", "value": "1615225979771b89e1106e17f9992357d78cc5b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230860, "uuid": "a0019e64-87c9-43ea-bda5-e2fe080cfe6c", "comment": "Malware payload (Mirai)", "value": "7f3a34a95dbb974102a06eaedffb0da7327929cedc3b3ebd1a7a9c3b3bea77eec015341c23b1d1c1abeb22eea1f3b68f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230860, "uuid": "9a03c910-7a33-4719-93a6-392e3021edc2", "value": "T1BCC31946F9828A22C5D713BEF92E118E331357B8E3DE72129E105F2573C662B0DBB945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230860, "uuid": "87c12e63-057b-4911-99f5-a4a935915e11", "value": "3072:vggcXParsxoSgsp7TCamqZT1cRySRlrF9sRE:vggcXirsxpTp7GamSMySRf9sRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230860, "uuid": "73332b32-9749-4741-b3d2-20e50a7684ce", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230860, "uuid": "01638455-47c3-46ff-b459-f427fb2ff636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230860, "uuid": "70b59dd2-b36f-4f33-a5db-91193d0c10c6", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35f776d-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200709, "uuid": "05caaec3-2f2a-47aa-9497-ed45bb82ea7d", "comment": "Malware payload (Mirai)", "value": "114d4c2547c1405d42efe921f887b1ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200709, "uuid": "f9f80d9a-7582-4407-b36e-b2e68f42c8f4", "comment": "Malware payload (Mirai)", "value": "0c3670aaa28a671a8f9e0a3f84d9b02355de8066ce2f81155978421643634471", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200709, "uuid": "44346a1a-2f4d-43af-974a-6ac837b2a070", "comment": "Malware payload (Mirai)", "value": "0f336f782bee3ddbf30d5757a4e8f437ed28ee60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200709, "uuid": "79f150ba-ae1e-4a53-a7f0-e84c58fe9909", "comment": "Malware payload (Mirai)", "value": "dfd68db84ed184608dac9356a3eb6b848de8958fa3ed8983c965c59350ba2a1a8c3c3db0b777f96dba500304257ac077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200709, "uuid": "39e91b52-6d20-41a6-acae-915320020f72", "value": "T137A35C22263A1B27C0E5E57541F7973AB3F65B892E65820FBE151E8CBF04AD035833B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200709, "uuid": "8c16bbfe-9c4b-4ee1-8d5a-08b3a5a7b55d", "value": "1536:d8RUsG8eMiTBn+KjtquFjm5dmKEF3HgV80chNXGzHiK/eEnlz6AHER8:2Gp8eMW9KGSV81ZGLe8lzT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200709, "uuid": "73f8bc7e-d03c-4325-b114-409919808bc8", "value": 105764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200709, "uuid": "f26b5f66-df96-4e56-a897-9b776e50ec58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200709, "uuid": "14195f29-8304-4e66-b4db-8a4eaa70dc67", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e35fa51-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763230712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230712, "uuid": "6bd5bab3-58b4-4922-8d8f-217150bc04c5", "comment": "Malware payload (Mirai)", "value": "a7f9d0c10ffcdc2a3df6ac4253c0bf8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230712, "uuid": "0728a1ab-9e62-4832-9919-704e3847e7b9", "comment": "Malware payload (Mirai)", "value": "0d71da56ee77a007d74663ad028f97c1ad3019498766e2fbf3e85bd7033623b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230712, "uuid": "3eab5ef3-e268-400e-be73-3cb69bdf7f7b", "comment": "Malware payload (Mirai)", "value": "0b4f061e47038f136b26b4c2f62c789c629165b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230712, "uuid": "02729d70-271d-4131-92ea-2359f68f9bac", "comment": "Malware payload (Mirai)", "value": "241c68b4f1ff3842aba4e30b91b5205bc1cb911fe608ceeb72da8f84631fd75e6d15472ad47da5c3512189ea1588e190", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230712, "uuid": "edeb6c13-c5de-44e6-b53c-a0a6ac39c02d", "value": "T1C2535C96F800CDBCFD4AD67FC5169909F424336486921F13A36EFDA3AC724989E2DD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230712, "uuid": "dbabd0cb-4463-4c66-893f-de257fa871f5", "value": "1536:dME/LCnbeNxwl7nzfV11111raHV2YSrMDw66se87MaTPn:d1/LkEsnzt11111rIcYbwfsIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230712, "uuid": "ac5541f2-b3a7-42bd-b7fb-62ab845e3c25", "value": 62408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230712, "uuid": "f7947f4d-1637-4412-96a7-b89759bb04d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230712, "uuid": "10a03441-ea63-43f3-a2b6-7733ab3624b4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05f43bf-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241533, "uuid": "c849774f-1aa9-43e3-9888-fb463fac529a", "comment": "Malware payload (Mirai)", "value": "db8f0d3cc02f49c3c10e74b93aa8679a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241533, "uuid": "138bc691-bdef-409c-b4b5-889efd5f2cd1", "comment": "Malware payload (Mirai)", "value": "0d7dd6f504d74271e4883aa266d4ed0c1f74bf84694af0976dc654a6ac3e65d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241533, "uuid": "06f53970-6005-463d-82a0-da8f2b209d12", "comment": "Malware payload (Mirai)", "value": "bf54eccaaf2a67bb13f25198074664475e7b1271", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241533, "uuid": "12ca5efe-e3a3-4227-b69f-a574604dd464", "comment": "Malware payload (Mirai)", "value": "21958ef950f53e1bee2bcd27e994a193e93ee11de17a8456f46da890e95b2c9f651769dc73e684b3ffb68a50fb01b021", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241533, "uuid": "9c10a878-f1cf-4b80-adaf-d3e05cfc88eb", "value": "T1ECA3F81AFF214FF7DC5BCD3745E81B0625CC994622A97B367134C828F65A14B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241533, "uuid": "87c98a51-ab32-4ae0-bbf5-6b06fd6820fb", "value": "1536:ErG57Za55vPc8T0j155sRXeBdl4W8OVdSGTQsrLP/KI/Wos:aG5VSvPc8YhBYG7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241533, "uuid": "2dbc744f-82f8-4f16-bf9f-58fe8c8e724b", "value": 101068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241533, "uuid": "648261ad-0e4e-4df1-baad-554fb6b57a62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241533, "uuid": "1b4b1997-c519-4c73-91f7-65f8c4fc845a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64944752-c1ef-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763189437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189437, "uuid": "72dbde94-a1ce-4b66-a5ce-25a0a905a247", "comment": "Malware payload (Mirai)", "value": "b23f87e64ae566f1eec6246b94b725cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189437, "uuid": "173bbaf2-3426-4813-a1ed-6506754c10b1", "comment": "Malware payload (Mirai)", "value": "0f31e5e342c317cad7fa837ced3e5ab89007333c9e1ab26e723800a0f1950891", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189437, "uuid": "42b9be4b-e30c-4bf8-948f-57180e678323", "comment": "Malware payload (Mirai)", "value": "cb7c2034e9cdada3806971db819f7fce8ebb1b15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189437, "uuid": "1dc75de2-2d32-42be-ab35-19fbc69bccfe", "comment": "Malware payload (Mirai)", "value": "4fbe7fdf3fe3822693a88e2c9c598af736dce737a62cac5529f7835b9593a8cfe60c4b2b3d6f37a2797ec3e59d4486f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189437, "uuid": "afcd25f5-873e-4216-a5b0-6b2a13bd5c08", "value": "T1A2B34A46FDC29622C6C627BAFA6E428D372663E4D3DE3207CE256F2137C651B0D67940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189437, "uuid": "1275e212-b363-40a3-ba63-848e6b42c6d1", "value": "1536:ePKnnpAXBK5tzVT47R50wUh9r1aCvaMjek+LNqzCXjP24gjCvrrEfB:ePUpAI5thhah8enLNxTbrrEfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763189437, "uuid": "920dc5c8-482e-4900-876a-8b8eee236509", "value": 112108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763189437, "uuid": "f36ea9c0-4502-4d82-acde-63427cb59cc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189437, "uuid": "472f126c-d2f9-4eeb-abdf-9b5e2c81e349", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b916e08c-c203-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763198169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198169, "uuid": "deb3bedc-2313-4673-b635-df9248bbb61f", "comment": "Malware payload (AgentTesla)", "value": "f71bfe3c2b4f732b4fd498ba8d88d224", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198169, "uuid": "545515e2-0a52-4cc2-83fa-ea587993c6cf", "comment": "Malware payload (AgentTesla)", "value": "1017aaf9641ba3b8ca65b266da0537a731b075f1d637073ae49ebddb621c61b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198169, "uuid": "7739d968-0662-449d-bf62-7439d3e289cf", "comment": "Malware payload (AgentTesla)", "value": "6749460698c5c62158bb872f88979d820f9b8e1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198169, "uuid": "d2588564-e781-47da-8211-19ccea423045", "comment": "Malware payload (AgentTesla)", "value": "cfff41c1394eb3d65fbf0e569e3fd97650f342553f49382dba2b0ce3d777202d32cae3ae678a37a7a324d956c2c071b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198169, "uuid": "1cbe2e5c-7040-4828-bacc-db27c86ebdcc", "value": "T138F5234B778A4D31C1585772C5DB400487F59A82FA93EB0A78CA23CB2D4F367E94A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198169, "uuid": "5393f1e3-a437-4568-8d36-4f899ef57c1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198169, "uuid": "e0cb92e0-6b2d-45c0-b17d-5c29cb715735", "value": "98304:Fa7im/aOJ0Hf/BbKaZXT11BRJ+8yME2zhYlRsgnRJK4:Fa7fap/5OaZDlRMYhmMiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763198169, "uuid": "9d2f7dc4-4924-475f-be25-03ddc5a4b45f", "value": 3615232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763198169, "uuid": "eee06920-d410-4032-bd84-d2e232a9791c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198169, "uuid": "f5a9aaba-06ea-4cf3-acea-118acb9fb58f", "value": "SilentCode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ade1ef2-c25c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763236263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236263, "uuid": "7ee0eb21-f867-4a18-9371-59830f5a53cc", "comment": "Malware payload (Mirai)", "value": "ac9255738a5bc4eabefb7f4696576464", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236263, "uuid": "0f43894c-1971-4921-aa96-c31091c93f36", "comment": "Malware payload (Mirai)", "value": "102137bb4fa5c1561e3e36c898303c318e4883ea4508318b812abc4c66f4294f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236263, "uuid": "c6941c94-752a-4977-879f-0b870934b24d", "comment": "Malware payload (Mirai)", "value": "9f2efb477a14b481168df0c0362a96bf4e629fcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236263, "uuid": "c4f2040b-fbf2-435d-b29a-b9ded99cee17", "comment": "Malware payload (Mirai)", "value": "b8f5187b18e89b5e88f70623cc1a776f3586f7792aff0870f418d797a9b459b4486caeb86cf2dd429a37f6b797dcdd47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236263, "uuid": "de8b8442-5f39-471f-851d-170be1393289", "value": "T13C23023763EC9644E8DA00F71ABF7B1FC021900B55EB71EC9A9461279A64EF013389B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236263, "uuid": "37d970e3-f079-4f26-8d33-2f94026129ab", "value": "768:JDFjdHw+OaaPC74Q2uGEepHnoOZE7sZafB8jSDADog0alyKnbcuyD7UHQRj2:JDFj++Bw9EepIOugMfBkDoTaPnouy8Hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763236263, "uuid": "66140fe1-bf67-4032-a4a9-b9fc98a0be6d", "value": 48036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763236263, "uuid": "9d3921cc-2801-488d-a332-2e9df65f615e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236263, "uuid": "f052f97c-2f0e-432b-b548-ab57eb3f1c58", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14434bf5-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (AZORult)", "timestamp": 1763240413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240413, "uuid": "aec04aeb-68e7-4cfb-986f-493ef715dc98", "comment": "Malware payload (AZORult)", "value": "4fd52e6f7cedc00d9955d25f403691b7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240413, "uuid": "ef471c13-6264-4f09-83e5-38a3e2168d49", "comment": "Malware payload (AZORult)", "value": "12464f68bb7e04a257ba9577929a5f1e9020e9b9a895dbec88bce4a4a247a675", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240413, "uuid": "19d5f101-ffc6-4cfd-8020-962d3ccf3d4d", "comment": "Malware payload (AZORult)", "value": "2db96e385c993ebf2b791b1633e1f479d656d282", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240413, "uuid": "009740f0-2414-4ab8-b28d-058a6cca4e02", "comment": "Malware payload (AZORult)", "value": "f026c38265df606adec96735807dfae1bc212fe0851c096fc62fd9d39a4c3f404f5ab939ff3a96c093df0a2272899e53", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240413, "uuid": "99a594a8-a0e6-40d2-86f1-d74401cded7d", "value": "T1FBC32A6EF7C19277D02408BDCD45A1B9907975302E391822F7E64F6CD8F96C2AA6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240413, "uuid": "58138694-2a2f-4807-8649-4102d670ce55", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240413, "uuid": "9c4c0cd5-844c-40d5-a3fa-9c528e01beec", "value": "3072:wxRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgiXVqq:0aO1tme++wiXMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240413, "uuid": "25e3cb19-ec44-4086-8997-f3d9bdbb4559", "value": 127836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240413, "uuid": "b56729d7-35e2-466e-acfe-285af08b41d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240413, "uuid": "ac7421b3-1f18-4f25-b52b-cd2a7a30ea7c", "value": "4FD52E6F7CEDC00D9955D25F403691B7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db11856d-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239887, "uuid": "d65860f2-f342-48cd-b0f8-4b1112883c77", "comment": "Malware payload (Mirai)", "value": "acf5872d84921e1b2eec3656759e0774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239887, "uuid": "47467ca1-ea32-46e3-9cac-47df2c6a1e9d", "comment": "Malware payload (Mirai)", "value": "12febb28eb7f9bca091bd063b00a7185c2bfa8a2468b6f68a69be050335a7c79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239887, "uuid": "575db27b-981d-4fa9-9d4a-87e214869916", "comment": "Malware payload (Mirai)", "value": "c0919163e2bdb6d5ad972bbfbb9782b6b2fe9928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239887, "uuid": "cddaf2f9-5b30-4658-807c-bbf723cbb572", "comment": "Malware payload (Mirai)", "value": "7b7f77ef774381fe8accc6f71a54af1ea0f2455579f50969c00ba415d6b5edbec465699f5b216525157982b5d23fc62c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239887, "uuid": "5188bfbc-bb77-4eae-84ef-be4cb5c23340", "value": "T113830795BC82862AC9E403BEB17D12CE332577E5D2CE7217C8110F657A8661F0DA7F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239887, "uuid": "c830dd4c-c5a8-460a-87a6-73c531002a9b", "value": "1536:IAtzyQHSx6RaHFP2lkZy5mjMwIcOKBXXDQi5ILGuiZnv89oJs:9uxjgKV9l8abZnv5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239887, "uuid": "093b04a2-9ff3-4ea0-95fa-08d6b23a606f", "value": 87940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239887, "uuid": "42d46432-cfd4-4f2c-a430-7ac7a1c5acae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239887, "uuid": "cd853b98-35da-49aa-9a4f-a31660c2db83", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e762bc-c24d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763229790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229790, "uuid": "b265058c-9a94-4ad7-bf54-35d857e78523", "comment": "Malware payload (Mirai)", "value": "51d1258eba02ef0d76cb550e2259a493", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229790, "uuid": "53995ecd-b4cd-41d3-9d7e-020d1e54f893", "comment": "Malware payload (Mirai)", "value": "13c4df50e1cac452500fa11a328b86e70414281a294016b02151dff0152faf5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229790, "uuid": "9d4bd43d-a187-493b-828a-ba6b0e2c6075", "comment": "Malware payload (Mirai)", "value": "15f95711496947f54b6f3676adc06ac3cc7dc5fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229790, "uuid": "3606d865-9a9f-45b5-9325-c6610d35e53a", "comment": "Malware payload (Mirai)", "value": "fdc6d4e19e4c8d7300b0cce2363d41eb5cefbfbbaba1c8c8a70a01f24633a5e5eabe453a6b562e13e193909c6ab98398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229790, "uuid": "89445593-d1cf-49b7-b9d1-eb285e404082", "value": "T18E23F177856FA270C82589738A0712D0EE9A6C7340861FCF29D6A1EDC977563CF22F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229790, "uuid": "e743648d-923e-40b6-a3a4-d7809560cb35", "value": "768:bApV3/HxLw6uJqr8ynguJ8io58Nt7+LQi57k0SjbGJ196H2ZhhRpDyVMuTBS92+A:bURL7uSngC4uoQi57k0gbAw2rhRpDdmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229790, "uuid": "4a077c9e-54a6-4261-ad2d-547899eae77b", "value": 47604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229790, "uuid": "79a78d00-339d-4f49-b4d9-34ff905019e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229790, "uuid": "6d9535ec-ff39-4ea7-9566-5183df4ec73b", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c686e10f-c253-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763232551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232551, "uuid": "c4244bb7-1294-4516-994c-59a8c28f5a24", "comment": "Malware payload", "value": "98ac2485b18052ef59313d9f5f8b6327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232551, "uuid": "43f0994d-a4ab-4361-8c13-77bdc00a7267", "comment": "Malware payload", "value": "148ddb73e5415fcb6564679c37c9361615d6d9c1650a1060e076b25ce28fc1d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232551, "uuid": "07362743-edcd-4e5f-9a42-d82ab3c3ab4b", "comment": "Malware payload", "value": "b064a4606401eb175eb110728dff9ce5d886209e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232551, "uuid": "bdb6fc5b-5cbf-4303-8fab-2836b1544991", "comment": "Malware payload", "value": "9cdd593d9a229e492d535cbf3d08873a261f2d5dd0561b1dec12acecc624c55daa2dbd8e4deba9e3998dc1423d15c57a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232551, "uuid": "626a5367-64c9-428b-bb8c-fd6ac6e17a2b", "value": "T16E342359C7C2D02FCC9CA3BADB4427B42C46E6911651F262E0B887EE1DDEF2553E3891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232551, "uuid": "db61a516-5aa6-4ac7-92ee-110c3709d662", "value": "6144:uVzIRjftYCB+szPxn/71lNz3XyFBeyhmRNOeH3qqd0:uVMRS5szFdeFyRceH3qqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763232551, "uuid": "abf5deb6-51d1-450d-8a39-304b733f3450", "value": 247640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763232551, "uuid": "f5d0b565-d1ae-469d-a510-7f28d73912eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232551, "uuid": "fcf237d8-e774-418d-86cd-c16ac18ae547", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d8b516-c251-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1763231532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231532, "uuid": "4aca15eb-cf43-4a47-8a54-ae7cee0e371c", "comment": "Malware payload (BlankGrabber)", "value": "bd56901aba57beed3a6b3875249b31e4", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231532, "uuid": "2d575835-c2e4-4e92-b025-9217e4bb19bc", "comment": "Malware payload (BlankGrabber)", "value": "14c4bb5cc9d5aeac320ecf639d6335ab0c5d7f018f60449b3fd19514d774aeff", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231532, "uuid": "60a40f40-de94-4f7b-810e-105d75273123", "comment": "Malware payload (BlankGrabber)", "value": "b070cdae7d3de10463bd21c27284e2097d2385b9", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231532, "uuid": "46656f4e-17e3-4c59-b5d1-8a4a0889bbbc", "comment": "Malware payload (BlankGrabber)", "value": "8d185a07e830b5cef298f47f59ae2c07f62c2ef64661177fc8834f81593a23bb97c95e14b275521fea362846961ae5e0", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231532, "uuid": "bcea8d0b-d557-4493-8fa1-8770fa352b07", "value": "T15BA63355A7A200FDF9AB557D9192D21A93B338720B60D6DF43A873752C374B20C3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231532, "uuid": "19fd1b96-4af9-467e-9eb8-b05f8afef5b7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231532, "uuid": "adc47fe4-771b-411b-87da-798804a94f13", "value": "196608:KuDR1fdwfI9jUCrXMvH8zPjweazpZ0cXI6F0ZcXKWGQ4c5j2dMa7:xDmIHrXgHq+9qBE/bR5jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231532, "uuid": "c8cc80da-0ae2-4401-b382-93338d294464", "value": 10300016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231532, "uuid": "4dded326-a986-40be-9d82-2a9fcf1830dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231532, "uuid": "e993d086-002c-4b6d-b603-ab37bb19550d", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b75e11-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240631, "uuid": "e1bfec3f-07fc-4e34-a0eb-4673776b1303", "comment": "Malware payload (Mirai)", "value": "ae3e9b99a8c9150a0f594c23ceaffeac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240631, "uuid": "011a1f82-4926-4e1b-af78-deba4a697542", "comment": "Malware payload (Mirai)", "value": "14efdcdee89841505abdbeeae0a2e3ff5eda46dd520fa4258881e684f3de66f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240631, "uuid": "863df429-8876-478f-9806-20995ef5a5ff", "comment": "Malware payload (Mirai)", "value": "9b0724d48d196f979d667530d96c12804157c78b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240631, "uuid": "76bb05a2-df0f-401c-986a-1f5bfc59dc23", "comment": "Malware payload (Mirai)", "value": "14a34fa7543c1086fe5c47fbd0d285236360f68e450a0ec6b115c22f02f6aec4918e38d81cd1c9d492622cd225b3943e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240631, "uuid": "a157b0db-1050-4050-89e4-3886485dca42", "value": "T127B2D03992854E76C1F7D13A2F961B22AF621AA77303EC0E659BB4539CC50E53807FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240631, "uuid": "4cc3a258-dce2-45eb-8bb3-20cf90352dc2", "value": "384:Mqjys++eEdpmNbLjOKBbcb9Q4kl1xnbIfDIIP5GKJgGlzDpH7uNj1Jbb:7mNbXxBmCD1xn8bIIBDJgGlzDpbuR1J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240631, "uuid": "7be81e24-7193-449e-85eb-7b7bd2500496", "value": 23872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240631, "uuid": "2f332d37-639d-4093-b074-2fbdf21ddcb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240631, "uuid": "1d362467-9be7-4472-af95-41864f3abc7c", "value": "brichs.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64851239-c24d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763229810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229810, "uuid": "0b0629c9-def6-481e-8a03-10ac496f97cf", "comment": "Malware payload (Mirai)", "value": "453b8837773df71aefc2f523c8b5daaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229810, "uuid": "58932946-3182-464a-b555-6cd6078b51c4", "comment": "Malware payload (Mirai)", "value": "15ccbd2c2e993425d6cf5677451ac5c4270866a3dea444c8d249f24e9d30a072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229810, "uuid": "5b4453be-f1df-499b-8b85-7915e22f7898", "comment": "Malware payload (Mirai)", "value": "914044f5e3ef411597d8b16c0a84b4b98e711f2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229810, "uuid": "ef1a7f20-96b2-414f-8ee9-4d759540ed0b", "comment": "Malware payload (Mirai)", "value": "da3f3fbd471b513fd7e9ea5f163f955df3cdabadd57d85a8839abc80bae8a9dfa392243a6997f3400f9c9be868c96293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229810, "uuid": "77156408-e77d-40cf-b2e5-d8b089595670", "value": "T111B34B03B9C28DFDC049C038437EB536D926F0EE1739B29B27E5EE266D0EE610B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229810, "uuid": "10d413a5-78cc-4363-8d39-5bbc9c857ed9", "value": "3072:zKGf4l7mDTXoeB+Egwe4oP1xAt+lLnuJTjtOEbQcG3cGG:zKI4lmvXoeB+Egwe4wJuxjn7BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229810, "uuid": "033956df-bc03-433c-abeb-b0c2e8a1dfd7", "value": 109968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229810, "uuid": "38120337-7284-47fc-ae03-d76a97e28b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229810, "uuid": "c74f7527-a47a-4277-9cd9-02d9f3dd0a7a", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a46676-c1f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763193848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193848, "uuid": "0078c8e7-ad0f-401b-a8de-4902764b3821", "comment": "Malware payload", "value": "88242f1c9347150c0fa9c24499e81931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193848, "uuid": "21daafd4-4428-4d18-a09d-4e353e14b8d4", "comment": "Malware payload", "value": "15d768ec6d01caec9daa4e6671f48377880ad2f917ed35c955d4063c5dad9e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193848, "uuid": "ad67ff53-51df-4a18-bc81-1837bbee0e78", "comment": "Malware payload", "value": "8be3bfb8299ae8adb70f275566c974f357e9e2c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193848, "uuid": "16af8b58-4799-451d-a986-70e655dcb828", "comment": "Malware payload", "value": "426b9236d46f38bbed455ccbe5c7f190c2963ac358b1da2f5bd16eee4c6d9fed86d9b9307362c7911e5e4ccdf236f510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193848, "uuid": "266236d6-d469-41be-9c5e-84659fcf66f0", "value": "T16C073364AB6014EEFCC3D03B654241D3B7F3B0242B75DADB1AA812AD3F978E12D39594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193848, "uuid": "85c52207-1feb-442f-8d93-b9e3743f8ad0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193848, "uuid": "0ab2b1d0-7cc2-4be1-8a43-8fd87a892565", "value": "393216:AqG8uSfdjcMo173sB1rnpDs1FIu7msaHHJyZ:AqNTdjcMo14B1FD46jsSJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763193848, "uuid": "75648d05-da5d-45c8-83d4-7270f8867046", "value": 18279002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763193848, "uuid": "083acd59-8f0d-4ba0-966f-ddad3a6186e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193848, "uuid": "54367625-2f16-4d00-adaa-327413321e99", "value": "SecuriteInfo.com.Python.Stealer.1545.28329.13917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7c6fe9-c1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763175792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175792, "uuid": "38d9005f-11be-4aa6-a818-1d94f00725cf", "comment": "Malware payload (Mirai)", "value": "f222e9bafb7e5f14d68d33619d0991dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175792, "uuid": "8aea71fe-fb97-4a59-8b77-06c34d1f30ae", "comment": "Malware payload (Mirai)", "value": "172f05e09ec4cb3b46249a1b16ca6194d789c3fe31e0789463a506c890b5c1b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175792, "uuid": "0f3e5a84-7bee-4ba2-91c1-5bbcf033fe4d", "comment": "Malware payload (Mirai)", "value": "d37eedb63ed4d278cef085b97afd19e6da7d232c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175792, "uuid": "d4af5845-1a16-4ffe-b8d3-06020bfb2b65", "comment": "Malware payload (Mirai)", "value": "ef0bd7dda68f37defce417e3644fe9e5265574d398ad7802d6ad35688fdc40ec2ea445ae0ea8b285baafc14541d9f457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175792, "uuid": "af8ff90a-568b-470b-8903-1654f56601b7", "value": "T13FE3A70A6F228F6EF165837447F70E30E79876D627E19685E1BCE9501F202CE641F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175792, "uuid": "a4869cc3-fdc9-4112-b569-1d1fcb5506ea", "value": "3072:NSjUtpI7DuiY+nX4Blgslf7z2HGs1HSOozy8Rze:NSjeYDuiY8sd+mMVoznRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763175792, "uuid": "50791713-c1fb-4dcf-8cbd-bc626539ea91", "value": 151324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763175792, "uuid": "c5a9904b-73cd-498a-b574-7abfc073e643", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175792, "uuid": "403a2856-2a41-47ae-8ab8-64e243e10a86", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f124fbe9-c1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763166480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166480, "uuid": "6e666a51-f24b-4b90-8310-6f84d6d04023", "comment": "Malware payload (Mirai)", "value": "0797cb6a60e9700470b753bbafdc3d8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166480, "uuid": "3ef04818-3a50-4ff8-8d8f-80e13b4ba35f", "comment": "Malware payload (Mirai)", "value": "195f8bea1de900690ef9958043e46f00ae1ad8c7bdc9dbceb836319c3d781acd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166480, "uuid": "54af513b-33b3-4088-a400-9bab83a28d56", "comment": "Malware payload (Mirai)", "value": "4712b1ed0ef966484407c293fe2f1055b345961c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166480, "uuid": "800f24e6-bdb5-4b7c-95df-07c22dcfd6f8", "comment": "Malware payload (Mirai)", "value": "7df0715d5bdda563ec853d8c368b532eeddc0a29c650fe55371b9f4e40f73e73a441febde8c9aefb55368f5e42a88355", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166480, "uuid": "f70ed082-735b-40d7-92d8-95c5dd37b001", "value": "T19413F10A41FE9F51CB4CA07249AEB81B2915F95D9EFF06AE465C5034CDD3E18B238268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166480, "uuid": "3288550d-4c7a-498e-9cea-ea7e471b19dd", "value": "768:FZa9qmlCJ7SWvi6qcDRpO5Q4f6j9QI/pwVDlY75MxhjOgCAWYPGnbcuyD7UHQRjS:FZklCBSkxqkqfABwLYGagCpnouy8HyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763166480, "uuid": "04b5a86d-acf5-4c70-a29e-1544e94f4e47", "value": 45272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763166480, "uuid": "4e4de3a5-8dde-413b-a8c4-ec47dfef2e98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166480, "uuid": "66cd3095-a092-4bd8-9e62-b5c3f53a176c", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9469bc-c1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763187624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187624, "uuid": "95db12a5-e5cb-4c27-bdb4-6ed36f9870d8", "comment": "Malware payload (Mirai)", "value": "db18e0f9aeafcdde98e996aea5ea6a95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187624, "uuid": "1f35c681-9cc5-4d7f-a8a3-cf7087c9ec92", "comment": "Malware payload (Mirai)", "value": "1af607e946af87c7d1fbf73af9a757b293f4ca2175a5ace22bba41b3b6be8f7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187624, "uuid": "85b9e4f3-ace0-43e5-acce-917aa75e5fd5", "comment": "Malware payload (Mirai)", "value": "ca7e5b6b7110cea001fe9c84346f6ba179ba3417", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187624, "uuid": "a89a56d5-36a2-49d5-b7e3-f358e03503e4", "comment": "Malware payload (Mirai)", "value": "a8cc25d0224a292d1793c4811705f0495315766c85bd662a1e734c5abf6ce73faaed8e0ed96fd00718475bb44bd11f21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187624, "uuid": "c9d2c47e-147f-45a9-873b-20405ae91f33", "value": "T12D23F29ECCE0C185D72F613A92DF2ED6C018E39E68F1D2A31980362564F1D5A7BAD344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187624, "uuid": "e92a6af3-29ba-4e50-af3a-3a01f95f3601", "value": "768:kd7RDthryipS17GdgGvgPumVb369mS7uvRyAwei/jlSa5kwRhpgH5UfaJNuAfVVX:kd0iw1WgGvyFwJaU4iJdgHA2cAtVykn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763187624, "uuid": "93ba89be-f4df-459e-813e-309c9fddf774", "value": 45964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763187624, "uuid": "fefa8630-9b7c-4323-86a7-99fcf2ec630b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187624, "uuid": "5a28ee20-f0e6-499e-a402-3007ee0e7498", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadb11de-c234-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763219271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219271, "uuid": "e7ce0f39-726b-4462-b709-7fc5728f08ea", "comment": "Malware payload", "value": "5bd94887493184e3e289b3122a89e452", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219271, "uuid": "7c7d5ab0-86bf-433c-8b05-21b5e46277be", "comment": "Malware payload", "value": "1be9782fe01bc1ec26e9b6740841214ef708f6e02b6705b078aafc3dc35679d0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219271, "uuid": "6572e9e0-37f1-458a-9f66-323e277cd49c", "comment": "Malware payload", "value": "c01bd89f02d400154dee632d04820df729536ed6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219271, "uuid": "d0df187c-b5db-4eb6-b7e3-f0b427a49dd7", "comment": "Malware payload", "value": "097ffe6b315350ba6a0c73a982a6bf532da5df48609085b6efdb9cecaabf599c1f0f022c42e564695ba9f0e58c72181f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219271, "uuid": "5d6d270e-29f3-45ad-8c8e-f7b2c86038bb", "value": "T18CD5339A2821A176CE1E07349FD340B5C1A60E137C30FE6EA1D67C581F7F3506AA64AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219271, "uuid": "09ae6e26-4c6e-40b7-978f-6557aba2469c", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219271, "uuid": "92cd0b23-d35a-44a0-bc2e-1e1a2f9071cf", "value": "49152:07yYNEZ5I5+JtKZm1PF/EozZEI2TfiF1/XBg9EBklhswSIy9WPqG3LRY4V4owgkM:02DZ5Si9/dZeq3Z3BklqtImWPX7RY4Gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763219271, "uuid": "aaa4444e-1843-403e-8c90-d477b7b8b99f", "value": 2832464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763219271, "uuid": "e7e3629b-7859-46a7-879c-33f573ac0743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219271, "uuid": "d88199a5-9b19-4823-9320-54689048d271", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb77b3ef-c201-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763197394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197394, "uuid": "a1062915-1dfe-452f-a7f0-0c03df7c64f6", "comment": "Malware payload (Mirai)", "value": "3386ec329fa22858481e373983443b98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197394, "uuid": "3235c4ab-91db-4f67-97c0-4b672bf4d568", "comment": "Malware payload (Mirai)", "value": "1bf5f1ecf1b1d84c30ef45537304c3d416ec239c89769f0fa986c67bbc1ee9d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197394, "uuid": "cec93c03-0cb6-4023-8f30-c9ec45004c98", "comment": "Malware payload (Mirai)", "value": "eef65cce26ee9eb4d917bec919e6aa14c7973e29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197394, "uuid": "d3b1a395-53a7-4804-a743-59de7f45fc5f", "comment": "Malware payload (Mirai)", "value": "af91594b6461232fa2af12c93c8c3d61351aa83888cef80c6197659369e4b8b374f91af24e63f3e620bd30e8fe2a26b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197394, "uuid": "283544ae-1330-4c2b-943a-036fa78ba066", "value": "T1DD436BC4F643D8F5EC8705702077FB379B72E1E52268D643D3B4D932AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197394, "uuid": "18f32ec4-293a-4b91-80e5-b1cdb8f1745a", "value": "1536:JeESt/basV2rcZhG6+hN7Tq9pW1ZzWOIaEjrqMds:JeESt/basVTg17Tq9w1ptXESC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763197394, "uuid": "1b737521-2588-412e-9a80-7badbecae9c0", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763197394, "uuid": "e0203306-ca31-450f-94bc-d65269bc6417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197394, "uuid": "247f724f-667e-451b-8dd4-93872038f79c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06923923-c217-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763206459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206459, "uuid": "01cec1ba-70a8-42ba-bc3b-2e80a70a4959", "comment": "Malware payload (Mirai)", "value": "b6ba890c6510056db33bac9c32014279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206459, "uuid": "8e097ba9-bb4e-48d2-9b5e-f16815e7e83b", "comment": "Malware payload (Mirai)", "value": "1c7575e3e287b1a55fda1821c1a888a840078528b4c734e3a7d28048b7b52999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206459, "uuid": "7bcd33e7-1b34-47db-868c-19d8fd4e2522", "comment": "Malware payload (Mirai)", "value": "464462eb45d772f3e7618c2ed63c9e87724d3b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206459, "uuid": "93c08d21-b06e-4642-90bf-eb56242c92e9", "comment": "Malware payload (Mirai)", "value": "a79ed8e119dda017d7408f2979632fe5d86f2169aebdfcf6a6a0cb1a6d88d58ed82e5444d788643e72700bca47318fd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206459, "uuid": "0a709abb-713a-4087-aa05-a4ac37d31d5e", "value": "T1E883E74AF9819B15D5D922BAFE1E118D331317A8E3EF7202DD105F2477CA92B0E7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206459, "uuid": "635d2000-4b9f-4991-849b-d92ebf8683a8", "value": "1536:pdnzDWyMTiFAQ+BEG8vzjbqotGO3IOUVpFmcJbPcEWqmllrYiNDyzs8uybVR/:7WyMeFMEG87jeEG3OunmcJbPcEkjDyY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763206459, "uuid": "ea8cc2a7-1ff2-411f-87ec-a9e6dd2cca66", "value": 84688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763206459, "uuid": "a46d2ff0-62f9-46ea-b46c-10da02f1f923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206459, "uuid": "3489b97e-1cfa-4cc1-964c-96c51e101324", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfabcfd0-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240754, "uuid": "4d0fab6f-7664-4d9b-ac40-05a70e3f3b9c", "comment": "Malware payload (Mirai)", "value": "54f9b8792064a70dda77fc066b3cc001", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240754, "uuid": "590edffe-8ed2-4be7-8fd0-28cb87628bf3", "comment": "Malware payload (Mirai)", "value": "1d331da00fbbb83c82eb50de871d88c247a2acfbd85f0feed65fc7d1f072fbbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240754, "uuid": "e6d30d1e-fd7f-41fe-99c1-82537ee28f06", "comment": "Malware payload (Mirai)", "value": "7095c914b7ff6e6aebe3e8ea489355c9a80bf296", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240754, "uuid": "f8f854d7-c249-44e9-811a-be30e1ecfdde", "comment": "Malware payload (Mirai)", "value": "8b8d3e24608cf3bad785e5ac9c3edad45bcf267a5710b4cba9a554e4d5be20c8ce44cdade6e3c354cca9a5889d31aaa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240754, "uuid": "78fa779e-2e6f-4513-8419-93d3458dca8a", "value": "T1A773A409BF600FB3DCABCC3709AA2B0529DC655B21B97F26B930D958B50B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240754, "uuid": "f0d07ddb-e298-4eba-8a27-634141928710", "value": "768:u6sqnUpjp606BmNsHM3gz+MQ9SgEcVt9o1NcA+j2eY/e6eT3evMiUebZL6qXiH7X:u0nUhg06Bm0M3PgNHi3sMpGZL69HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240754, "uuid": "eaeb0c74-f170-4dbf-a02f-bcd202c4ea5d", "value": 76124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240754, "uuid": "fbb09211-3c6e-4861-8ea0-8fe9f5857650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240754, "uuid": "d98374cf-c2b1-4e0d-9d91-ad52355a7420", "value": "brichs.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eee4cbf-c1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763184676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763184676, "uuid": "d672be7a-00d4-4268-a677-9feeeec8af76", "comment": "Malware payload (Mirai)", "value": "2398e6c10575e7a28f639ba594bb2a31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763184676, "uuid": "82556cba-79fc-4b65-a3ad-fbc8ff88d5e1", "comment": "Malware payload (Mirai)", "value": "1e3419d376c68622116d424b5046a6036f7612f37962e4e8a43ca6769ddcd991", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763184676, "uuid": "67762a7b-d688-40af-844b-f0ff32818476", "comment": "Malware payload (Mirai)", "value": "2e1d4140c148a95f7db0984d91ae52b8dda06550", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763184676, "uuid": "74ebe7fc-354b-48a8-a4dd-fe5f9b4e433a", "comment": "Malware payload (Mirai)", "value": "f06e270cf7ea7f30156373bff9f50dab0da85a62696da7d8080424a148ae95ae12e57ce142a603b1b085ca64bf6e0a33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763184676, "uuid": "b07e8c33-85a5-4c92-a387-e4b518249650", "value": "T182B34BCAB801DD7CF85FDDB644674E0EB970A39256831F26629BFD93AC321A17813D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763184676, "uuid": "d0cf1502-4e7f-44f7-94f7-d728cad1acff", "value": "3072:NFuB/MXHxLtyrRDg3zcfHHQvvJGVtv8MaNsp0nRt6mgSh444w:buRMXHx6cvJGVN8RNTRtMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763184676, "uuid": "6c6fc8f9-decb-4c5b-9c1c-9e40cd1781a7", "value": 113572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763184676, "uuid": "41430731-f917-4d82-9365-2700c596043b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763184676, "uuid": "bce44777-3954-4f23-933a-bc2ab60758cc", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4b1b57-c1be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763168245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168245, "uuid": "828d45d9-5b7d-46ea-8211-0068d9c7ac55", "comment": "Malware payload (Mirai)", "value": "09cdeeedf24e42b4f3497677437bdc0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168245, "uuid": "6feea061-cef8-4c1f-ae8d-1727cc1343c2", "comment": "Malware payload (Mirai)", "value": "1eaf659ecc672faa1e91530ae1a33eac1c45ef6337b895832d37ed38cfa5af04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168245, "uuid": "7da9866f-9762-4653-90e0-7274593521ef", "comment": "Malware payload (Mirai)", "value": "c19292081375b929c3fdabec4f10c9fb7a2a04c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168245, "uuid": "c4de8bee-6e38-491f-a509-b17a2b497699", "comment": "Malware payload (Mirai)", "value": "417a906fcee626090beaf4353dcdbd33df40bd0a2618b852d54a14a5acfa9b9c72a0ba66a11b0787f8c9f842a25e7206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168245, "uuid": "2d3d094f-4ac7-46ce-8de2-7ef9d347b0dd", "value": "T177B36C42731C0B47C19709B02E3F6BE687BFE5D121E4BA89251FDB6686B2D371449EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168245, "uuid": "f05bcb8b-1e5d-48c2-9846-17e9d8a24d32", "value": "1536:hgj/S5HRJwKpBuBgbldZrKJRIIgL9M+puQVC0vHVQz0:hgj/O1BuBY1rOY9TuoSz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763168245, "uuid": "9fe10c94-67f2-4190-a520-b73285c457b7", "value": 108108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763168245, "uuid": "375d888c-4aff-42f6-80b5-6bd0cdae07f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168245, "uuid": "01c7d97a-be8c-4b14-94a9-bfa7646049d9", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ce53f4-c1c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763171461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171461, "uuid": "51813cf7-6962-463b-a094-d389ba201b86", "comment": "Malware payload (Mirai)", "value": "f9fc84c0ea7742f11b1eaf8cd5bc5c8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171461, "uuid": "5bb341b7-e50e-4a32-9406-2360d7645187", "comment": "Malware payload (Mirai)", "value": "20132a62a43c95c41dd4537dab282736187a03dcb2a48b1e2abfef23881b247f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171461, "uuid": "ac52e4f0-b784-4b82-b298-8a8ce5f10a22", "comment": "Malware payload (Mirai)", "value": "59fb0fb18cf38e7b7e9ee75fe38a1cfa1375b658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171461, "uuid": "b1bb599c-8a42-4836-85e8-fb8569e6dc3b", "comment": "Malware payload (Mirai)", "value": "bd06419f394de6f9852e16c9c4923b2f523c4ef101c94731577cebacb979c1f43fbd811cc74900c3bfdbd0269b1d8573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171461, "uuid": "8f8bc643-6e06-4925-a6f5-da6c466fbfc2", "value": "T1D5B36C25B8391E27C4E0947B22F74366F1F617D914A8CA1E7E720E8EFF252503647AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171461, "uuid": "42a58636-d67a-4847-a5be-70154e8aa1a7", "value": "1536:hvlErUq4LhoIiH4RhVTsAav0o8b8SzURNLjNZBKivZ7O+rauLti6Ym5zagQAJKth:L2glXsNL77O+uQ46YOzj7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763171461, "uuid": "e83809d5-0550-479b-a0a5-4ffd6502b057", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763171461, "uuid": "06805893-e7b3-42f1-9cbf-c1a272456897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171461, "uuid": "6bc7b6a9-9bc2-4a81-9b68-8a73c2fedbf1", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d587e768-c22b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763215397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215397, "uuid": "a7371a05-0c94-4c84-8974-c06c0dfd6a16", "comment": "Malware payload (Mirai)", "value": "bbe0bfc43da283353f78f15e4efdc0f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215397, "uuid": "0f461001-3546-40e5-bb56-a98a6b13b230", "comment": "Malware payload (Mirai)", "value": "20b10e19db7094870b5c049dfab380a9af22bf0ab6b857d016f6e1870e0555a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215397, "uuid": "8bb8b8d7-c3a4-4aaa-bb00-65d52b9b0b03", "comment": "Malware payload (Mirai)", "value": "b83e1871d157d123a2b98a3af4b9d73053c4a7cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215397, "uuid": "260a0167-fbf6-455e-a25b-a62c3cd8abdc", "comment": "Malware payload (Mirai)", "value": "a2d30cc57b39d71468e83907040433234349dd29afb1ec82ee636c4ecdfc80f533fcc2822967bf68c69ae1c2dd136f94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215397, "uuid": "41c9beb1-e430-4dfb-b1af-ec2d1da91334", "value": "T161D3AEA7B74715A1C8A302F40BCB4BDD2E6332825F6B98E3BC6F653758760DB4406B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215397, "uuid": "c88b9f9f-d67f-4cee-a992-04c2a5d02deb", "value": "1536:E9xkaH6MYvdcqcJZHQqNXPdRaIeSFSR/89TdbpYgdudxZJ+Rgbv9/LWB:E9xkc6dcr3XPdRB9+E93FduiRgbv9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763215397, "uuid": "39801070-f5e1-4a33-a1fe-d385b024f2e5", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763215397, "uuid": "b37fb5d2-bf55-45e0-b417-0459bdccffbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215397, "uuid": "640e5598-aa85-4dd3-9ea8-980ca967cfb4", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d52f16-c24e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763230179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230179, "uuid": "96eec6c3-1439-4ea4-9886-65c48dc80af0", "comment": "Malware payload (Mirai)", "value": "0f6a8558568a4bcd0fdf93f48422f74a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230179, "uuid": "47e2208a-6f98-436c-8e83-977a5610a5fb", "comment": "Malware payload (Mirai)", "value": "20e568092c2188cd8ebdb2a9110c2ef55f7eef7d77ca65fbe64491e89821a5c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230179, "uuid": "e2da797e-4a9f-4a2b-983e-739215ce82a3", "comment": "Malware payload (Mirai)", "value": "f3caae02cc476c7b05c6b36301313ad7cc3bb902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230179, "uuid": "1490286e-fe4f-48b0-a090-a080362f1552", "comment": "Malware payload (Mirai)", "value": "a4cf2be911c23e42c0c15f8e99a7807bc343b10f7ff26aa9fe5649dde7fb49efd02748d8345fe6119d70d0be04b9a180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230179, "uuid": "6e638188-e95d-47f6-803b-d7a60d55be59", "value": "T11083C5057B614FF7D8AFCD3749B95B0428CC960A21A83B797D74E418F25B24F1AE3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230179, "uuid": "63bc8302-2785-421f-b34a-9bf8c3d369e9", "value": "1536:GA0h/x+qdC5NgVAZ5QRvMNV1dSxAhErwk2HureuybVR:LA5+qdC2qa5euy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230179, "uuid": "702099b7-c579-45b5-a87f-7585a610918d", "value": 84232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230179, "uuid": "ac6cb037-ce7b-40f0-a25c-998630c25067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230179, "uuid": "b0db725f-4836-4f09-bc11-83097874e4b6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9617a021-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240630, "uuid": "03d49d4a-dd48-4f69-8002-abdebf721525", "comment": "Malware payload (Mirai)", "value": "93122eaba53df12f0c4e4db5d50960e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240630, "uuid": "178ed607-363e-4214-b857-b93d6d701678", "comment": "Malware payload (Mirai)", "value": "2104c30ba636880f230663240d8f9db5a57ae1f4476cb59e9ecae92deb9716bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240630, "uuid": "5b786d52-46dc-4a04-9f1b-f9f3435b353d", "comment": "Malware payload (Mirai)", "value": "034333153ddab3cca7b3ed3f3753fa7239fd1006", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240630, "uuid": "fdb827ac-ad94-4e75-9293-f6e212ec93d8", "comment": "Malware payload (Mirai)", "value": "1721b89ddcc5a115b48477e09e590ded158c50ee582d9c3f376072eb848feaf9392b261537211fb77b9fb4e65bb18f83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240630, "uuid": "4a382370-25ae-4389-8d83-aa648fcb12bc", "value": "T176B38CEBF24712A0C86246F007CB4BED3E2323815F17C5E72C6A657968791DF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240630, "uuid": "847ce3b2-b0e3-4962-95b8-a58bab1b6be9", "value": "1536:Ut3W34h3ev80SpDogd17hIRZWNgV7/LWl:q5v0y8grhIRZWNgV7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240630, "uuid": "7da48c64-e3c3-4c25-8246-16f25b19116d", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240630, "uuid": "8716a397-2eff-45d4-9288-361e5629e8cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240630, "uuid": "4e5245c3-f529-4cfd-8942-ddfcacff37a0", "value": "brichs.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08146235-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230514, "uuid": "ee788937-ab27-439d-9564-934b6ff80ba1", "comment": "Malware payload", "value": "90ac09d5f73342792effa23727388e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230514, "uuid": "d692ccfc-fe00-4916-a6b8-1b2df5ac1619", "comment": "Malware payload", "value": "2120f4e0085607dd5f96709d99b84762c405838df0efe4433e523531be37e1ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230514, "uuid": "835dfbfe-fc77-4a6e-bf9d-b5da7945d97a", "comment": "Malware payload", "value": "b5144ee46166bcdbb2561fc101795ed75c1e03af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230514, "uuid": "a316218c-0808-426b-9e24-0078acbf7d64", "comment": "Malware payload", "value": "e63ecf410454151cf9788a623e868007494d970fdf8e35f14bbee54455ac9f8471c7b6dabafe9739f321227c91c7e435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230514, "uuid": "5553f032-86d9-4ff0-b557-d7938c59ee9b", "value": "T115A5BE5AA7B410F8D96BC13CC9734517EAF2B4561360A7CF07A086A61F237E09E3E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230514, "uuid": "244797f9-8b26-418b-aa1f-07feeb96b67e", "value": "b5d61f5401f957a1fa7397e1c31a7f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230514, "uuid": "a21d84a2-69e7-49f8-97ed-a527c832385c", "value": "24576:BMWbfdvNJ0yMTA7uivx7jVy/AUayXLjakhdeywfG5JLCgxZ6FMkCCgx+l6IONflX:6WxvNoTEDx7jVy/AUayXSStHjtvDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230514, "uuid": "047e6fed-642b-4179-b9fe-6aea11ea4092", "value": 2063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230514, "uuid": "ad309de7-9010-488a-910c-8c0e15ad04ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230514, "uuid": "b52fbf73-14ee-41a6-924e-f09a2c343131", "value": "blvxqwmt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b1b2c3-c222-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763211506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211506, "uuid": "8708d8ba-b732-4c94-b0b0-bf0f10bd64fe", "comment": "Malware payload (Mirai)", "value": "42e1821e89ec99b0640073e9f5a3c5c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211506, "uuid": "edd2a7a9-3d37-424f-82cd-20bee425e637", "comment": "Malware payload (Mirai)", "value": "21fd1445724099beaf0f0a884cf886520bb5ea154a5cc0b1d28c3c288f867744", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211506, "uuid": "291b9853-2e69-4882-8144-eba932989103", "comment": "Malware payload (Mirai)", "value": "4e5c794bc3c9b1c17e981f0e0539dc576d5a8fa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211506, "uuid": "878bdd7d-c1f9-4ff1-900b-089c7ab558b7", "comment": "Malware payload (Mirai)", "value": "6da353be1c5366e66f78f440a41485702b799d3782d2c195ae4365407c5a762be1fd1659927f1ec976075080a1d7c2dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211506, "uuid": "5640d3ba-c335-4038-b664-0357cf455d38", "value": "T142D35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211506, "uuid": "56eb6908-5705-4e84-8b1d-1c59157874a5", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQf:yIRfe3xvvSrlvZZ7Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763211506, "uuid": "930d84d2-d173-4200-b47e-0b7ff8ee7120", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763211506, "uuid": "1b94ebbb-870a-46c6-89ae-7f8e35b2492b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211506, "uuid": "3d4e3164-38b2-46a9-8269-be806687972c", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06302a10-c250-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230940, "uuid": "0a920908-97cb-42ed-8ed3-b496186e9fde", "comment": "Malware payload", "value": "0e78104af8694348e36ce8c556e2a110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230940, "uuid": "9c86119f-f8b1-4870-9daf-b5beabb12a70", "comment": "Malware payload", "value": "21fdaa333d83d7f30618edce4a415732b9c22dcfe2fe4ad076efec3d56515bf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230940, "uuid": "5f6219b8-a32d-4512-ba5a-424abfd5a1ee", "comment": "Malware payload", "value": "7148d2ebbc3da8b40c5a96276e7c80922b5577c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230940, "uuid": "f9244657-3954-4056-b4ba-807426dcab96", "comment": "Malware payload", "value": "8ac45ed55bee95dab7e8869415aedea8de937af01a9f24b18b1ddad192418b785f841b3478b25eef6e617a4a1a3b7c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230940, "uuid": "e27ac691-310d-4d4f-849a-30bec8324357", "value": "T176B5AF65ABB420F8D56BC13CC9734517EAF2F4551360A7CF07A086A62F237E19A3A3D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230940, "uuid": "850a9db5-1334-4c95-8bfd-40f400dec796", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230940, "uuid": "69427c94-d9fc-40ef-9b56-af9e8d8fe2b5", "value": "49152:xcf13mS5Az6MuwHCjiDP4qI9q4KvFzVH20vDnj:x2Mlz6MuwHCjiD+CVH20vDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230940, "uuid": "a898e16e-5dfc-453c-82fa-5f5f4888ecda", "value": 2309120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230940, "uuid": "7143cfbd-4703-477f-b3c0-f6f014a512b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230940, "uuid": "dda61e21-765b-4ebd-9f78-3e7e7e6c9e67", "value": "jsga2w.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf6d912-c265-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763240241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240241, "uuid": "00ab5fc8-7936-46cf-ba38-397e1ae1d336", "comment": "Malware payload", "value": "9542f67abd1f31513699502fa3e80a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240241, "uuid": "a51f212c-fe62-4957-955a-f0879aa3660c", "comment": "Malware payload", "value": "220c93a92bf700eab2667c24784aaa646e20fbfffbdcd1826e89e45a9ea22050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240241, "uuid": "fd43f072-2c51-4557-8d4c-9e41f0878c62", "comment": "Malware payload", "value": "5cc26e8245bf52c98002d402520f7f12598f3818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240241, "uuid": "7f458266-d723-4624-8ace-522f446b1d2d", "comment": "Malware payload", "value": "19ad2c652b116f884f56ae2c4349ffda0b71278ff693c61f2abab4e5c1b0d6ad5dbbe89dad5215e5671cd107b4f11e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240241, "uuid": "e8a56f18-9ad1-40d1-93b5-1d03fe446f5f", "value": "T1E995235A02B464A7E575DB70D8F902079A31B8F14B3858FF24D1C4FE4F226A4EA72B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240241, "uuid": "148a9395-1fbe-42e4-bc56-752fe5302699", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240241, "uuid": "7c6b455a-3dd1-4cbb-9004-8684dcf5a99f", "value": "49152:pjppeJl/YV7DC3s1IyL88kJnBTa1YNdHpEsYGjJv:BeJl/YJDP1O8kFBT5NYsYGVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240241, "uuid": "eb22de2f-7fc7-4aa6-af9c-14b023c74707", "value": 2056584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240241, "uuid": "021ca6dc-5b80-435e-be28-83c3c91e991b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240241, "uuid": "9ab6a13f-95ef-44fd-81fe-8aefe33c3746", "value": "Kiddion's Modest Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b89a64-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200712, "uuid": "90694c85-96fc-403c-82fa-b021b0ce4b33", "comment": "Malware payload (Mirai)", "value": "bd83c3d27046532bb49c1610ce82691b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200712, "uuid": "56f40cfa-8646-4a3c-a0a8-41d8557b9088", "comment": "Malware payload (Mirai)", "value": "22b50cd47f0f3fb733e95c2c50152522881d65b43dec696bb46d4dcfe65c0315", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200712, "uuid": "eb9c1a5e-ee13-4d4a-9ca7-808d050bbcc8", "comment": "Malware payload (Mirai)", "value": "3b59e444923611205efe74224c621590a9cf7c70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200712, "uuid": "5a22d097-1c26-4e19-a984-ab3c4f471de0", "comment": "Malware payload (Mirai)", "value": "3e9ab6984c6721d4747e220211b5d66706dba3049816b30467f78a5d6492a08a7b2b01b93b20f79749732f8e1ee6848c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200712, "uuid": "8e0a6d84-d7a2-4122-9bfd-7a2f818e7ed5", "value": "T1A6833A017228098BE6E319B02A3F27F183BADD5620F47659654FBF4686B1E321486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200712, "uuid": "32cb1777-007c-4a1e-b1b1-0837065d5ba6", "value": "1536:x62DDx57s+PmA3Q4FCt1FQmST35yCP34fQLkj2itKRHnbrX:z/PY+PmT4FmlS5tdPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200712, "uuid": "7b7eda29-4821-4dae-bb85-fdb6b5371c9a", "value": 86732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200712, "uuid": "db2ee845-c7b3-4ee2-af7e-705d6496fcc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200712, "uuid": "0919eb5d-1776-4853-92e0-6938bd70b14e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fb0796-c256-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763233590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233590, "uuid": "2f697cbc-3052-43c2-bd04-a98c5161f6af", "comment": "Malware payload (Mirai)", "value": "ef301c7e589495799bf8187b7447d4e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233590, "uuid": "c634e4e3-96be-4f65-b0d5-36e1a5e05639", "comment": "Malware payload (Mirai)", "value": "23c81b361a96e2884bb187ba241e751cdab9f5da2f1dde37dd2c9c8e1505f9c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233590, "uuid": "b2c92fd6-e7b6-48e6-9fdb-8d26ab0f65a6", "comment": "Malware payload (Mirai)", "value": "64af5b52b3bc4d1660d5d8ae1cfdbeeea965c17e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233590, "uuid": "067a8155-ecc1-4b31-9be1-b047fa8630bb", "comment": "Malware payload (Mirai)", "value": "b4b0311167a17de5342da8a7ca3cdb576ad7f7d066f5b8a8acf89301f700eb1b81bfa82c1f633f9ad37c0dfeef54c0f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233590, "uuid": "1c07fbcc-85a6-456e-aad3-7edbabbb49c2", "value": "T12143F14A04A9CF9CF51E8235F97E273E4AD074E9E629B1E10100BC615C692D83A1ABDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233590, "uuid": "55da4bc1-fc8e-4ef6-8edb-3d33b25dc91f", "value": "1536:vE461DWtYyARBOXv3HaWqIshzw26e6N6DiTYwwvnW8Xgnouy8HyF:8RDE5XPHXziSBN6KsnW8XIoutG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763233590, "uuid": "b651212f-1f0f-4541-993a-c21af0fe2b3f", "value": 55316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763233590, "uuid": "55ccb015-338b-47cf-8d8c-73bb677b3e23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233590, "uuid": "0a449483-f14b-418e-baba-10f23cc3b5df", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b600e566-c1bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763167240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167240, "uuid": "fcfc9f58-b4f7-4bac-a3d1-83b0678a319d", "comment": "Malware payload (Mirai)", "value": "e19717d7d7b35ba488dde2f15f5ee13f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167240, "uuid": "9054829c-fb7d-49b2-83a3-5c92cc0f7516", "comment": "Malware payload (Mirai)", "value": "248862ac8bdae547477f0b08aa3f15058ae6bf0f664279964b61f2a74d1e99ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167240, "uuid": "9de20693-c65e-4a58-bf2c-cae91e203c51", "comment": "Malware payload (Mirai)", "value": "d3b21d5f92bb124705f610fb67f930c7a0b492bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167240, "uuid": "65a060d1-dc31-4471-90cf-12d4b4222679", "comment": "Malware payload (Mirai)", "value": "dd95658dbaaac7c4005867dd63360c38f8c2407e0da3893d4d950c7a169cdb6f094b4b9042280a4c750ca8f8608bea76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167240, "uuid": "374110de-d312-4953-bb0a-24a0815ecb60", "value": "T15EB3E806BF611EFBDC5FCC370AE92706258D640A22A97F3A7934D928F50B21F19D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167240, "uuid": "24870c5d-49a1-45b3-8e24-a7bc96b79612", "value": "1536:ucIpw2pg/Trn1SfTxTbHrUu4gY+GW5sp92p3j+QfH/2ZWvFsGH:udF+1UgTgY+Grp9JANv6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763167240, "uuid": "ef142493-1ac0-4df6-b3e8-2fbd597d697d", "value": 109800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763167240, "uuid": "1185e9f5-794f-4096-8940-6225cee480e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167240, "uuid": "3b7b0a01-425f-4be4-a884-d21108a836c3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20eb701-c24b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763229081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229081, "uuid": "9c593e3c-ed2a-46c3-baf3-497047be614e", "comment": "Malware payload (Mirai)", "value": "e21a26fe091aae516cb56b83183db4ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229081, "uuid": "5efa3d7a-5658-4502-8edb-459fefc33d5c", "comment": "Malware payload (Mirai)", "value": "25065b23fd9d6e28220ff769f3277344ea8237999862953f9bbb546744c1dccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229081, "uuid": "f82f8905-5459-47f2-9c43-46b77341ad8d", "comment": "Malware payload (Mirai)", "value": "d427dc6e1cfabd533d7824eed7a3cc7854c0a366", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229081, "uuid": "83e30cb6-19e6-45fa-b37d-d9d39382857f", "comment": "Malware payload (Mirai)", "value": "a9d2b33b485f9cff29453e646ace41187ec4c9f35ef36c9bffc93f71810e3fee02968bc2f10428b5a8765a63f2cf707d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229081, "uuid": "e15c3b3b-637a-492f-bd0f-a085ef2464ca", "value": "T1FA53029DA78D0CA2F8F6EF68291C9A8267B147DC4750ACF04144DF2272EA91772C90DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229081, "uuid": "806d55b6-ced3-45b7-a49e-7a96e735218a", "value": "1536:fYKMZ5k6AJyhFuah4PGmmmCaI54u+qgw09i:fYVZ1AJiP4PVCF54u+qgw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229081, "uuid": "5d46c1a1-9472-423b-adc0-34143b44616a", "value": 63652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229081, "uuid": "f124914b-585d-4364-b453-754bcf5b54e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229081, "uuid": "6a689887-8787-4f09-8736-793639b79a47", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94143f73-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240627, "uuid": "dba683d8-8da4-485d-8e48-35ce826f41ea", "comment": "Malware payload (Mirai)", "value": "8ceef53ca66122352a07dee95c6f6016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240627, "uuid": "27ba632d-3012-4812-bfc9-2efa4bc659f6", "comment": "Malware payload (Mirai)", "value": "255a1bffd8a449c15faec88fb0d2247db4a5fa847d8efce6e863ba5195ddf8e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240627, "uuid": "1a3ac986-ee75-4c79-a437-1ff5e6cbd57b", "comment": "Malware payload (Mirai)", "value": "36c0aaab191557826016c9f1950d90b859d36653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240627, "uuid": "8009f63b-43f7-4188-af9b-71297fec7faf", "comment": "Malware payload (Mirai)", "value": "e57dddb22509341a9863c80f71e23718ce09b79442ba52bf3c6d314f1a8b49f67a8c41b5ed2172b7b6f65df39cd39d96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240627, "uuid": "9ba49e8c-4e32-42c0-958b-b82686dc3a1c", "value": "T11CB2D09DE3BCAD49CE4CEC79B09A43A189A5F1D6123353EC57124C8CBAA3E46704D875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240627, "uuid": "d65066ef-e419-4ce1-84ae-6a44c5c0a239", "value": "768:ikchlX2YLzKOEm+3wZxLaOkGZ8OYrj8WH:CD2wzKOSaaOh8Pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240627, "uuid": "2d6c9fc7-31f8-4200-b7d7-8a3301751807", "value": 24980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240627, "uuid": "05ad5a99-9af2-4d97-aedb-b733b5799c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240627, "uuid": "748309f9-e8f0-45d2-974b-db434bc7de77", "value": "brichs.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019ff00f-c250-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230932, "uuid": "3bc056a6-2807-47c5-8d57-f2ad808a0749", "comment": "Malware payload", "value": "7e86f56c38409bb4693915beb3efe70a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230932, "uuid": "b406e894-c928-4a7d-a4c6-3447639fa8dd", "comment": "Malware payload", "value": "26cac2ab8683aa18cb4e7932de11c86e78fb91253af15572de7bddc96f5a8312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230932, "uuid": "5c6475b7-d592-4890-915a-3716ad89a383", "comment": "Malware payload", "value": "88a4773cb5baf98c4931e51c4b36d7806adb0fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230932, "uuid": "e16b57e6-7c47-4798-b7c4-2b84967a0b16", "comment": "Malware payload", "value": "4155dc1997bd8dd22621cdaf582e3f5e75545759f3e76843d5ce0d3e62e0edd5fe37559759a24b3a46a0ab98b16521ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230932, "uuid": "a76c1024-d7a2-4c66-afff-dd62a43d3d12", "value": "T174B5BF65ABB020F8D56BC138C9635517EAF2F4551360A7CF07B0C6A62F337E09A7A391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230932, "uuid": "86d62b83-8d6a-4b20-a9b4-2fb28d2aa6bc", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230932, "uuid": "cc56f1a7-4bce-4af2-ac5e-e7235136b607", "value": "49152:4Kf13mS5Az6MuwHCjiDP4qI9zpKvBvVH20vDvf:4gMlz6MuwHCjiDc2VH20vDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230932, "uuid": "0eab2e0e-0e70-4969-9321-fe8f0817603c", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230932, "uuid": "763b84ba-4309-47e2-b507-8eb4c2627c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230932, "uuid": "6b3f96fd-4673-4bb2-aeae-e46799490b09", "value": "jodw2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f450e4b-c22e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763216352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216352, "uuid": "fa8f3019-838a-4f10-906d-4b10817e1a12", "comment": "Malware payload (Mirai)", "value": "a73ee1cbb4adc4997c315734ab1a076e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216352, "uuid": "fae1b8e4-57f6-4deb-a4f8-1296725a7385", "comment": "Malware payload (Mirai)", "value": "2751e0e25ffe42f7fc12a58d01e2a23f4bc18ace397fdb0d4a001597b60fabfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216352, "uuid": "2a4a596a-c689-46bc-89ec-99b1cadedafc", "comment": "Malware payload (Mirai)", "value": "97c873fcca9635c927ef9c6116286f1a107f5097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216352, "uuid": "f1ec6802-5018-4b28-a2ee-43ab3a320e43", "comment": "Malware payload (Mirai)", "value": "a7f5f4f3fb327a177cde26cdf995f2c5869b8b2e4f480ba449a3916c7c740b6d977188a9bdd91574fd3f18e2ecb64a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216352, "uuid": "bab28679-8102-4372-9e9c-0766f3399594", "value": "T111147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216352, "uuid": "e9fa4938-51b5-421f-8621-53c3c10ab5e0", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRjUKG:IcY5JpMByVs9jSif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763216352, "uuid": "69a9483e-4d66-48aa-98ad-81037a1d4d98", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763216352, "uuid": "84abab99-a7c7-438d-94af-8f932ac374c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216352, "uuid": "c5b9fab4-6ac8-4d96-b6b0-3fdeca0aea99", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975d1d6b-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240633, "uuid": "a1469d13-3b01-4d64-808b-128fd6cf1a57", "comment": "Malware payload (Mirai)", "value": "0c4908eba29796fe112cba0361d83544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240633, "uuid": "f31e7341-c434-44fb-9377-04db312beeee", "comment": "Malware payload (Mirai)", "value": "27ff3520c94a2ff164312ed5241d248a9467cf1ab6ae6c738cd04543ffbb628f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240633, "uuid": "87682ea0-d52a-4961-9b41-0701f88050d1", "comment": "Malware payload (Mirai)", "value": "a07f0c84cdfebc4535d2b241594d8b0ef548e0e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240633, "uuid": "c8820a2c-81b6-43d4-87d6-5280d977ad2b", "comment": "Malware payload (Mirai)", "value": "0b4e300d91657a23ecbfc6165e1fbcb75c37bdad14f120204f1502ef823c816d64f3d409cf4c41ea13a398079d293d08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240633, "uuid": "248780d9-985c-4e8f-b833-405e4b5c51a5", "value": "T1B0A2E01077473CBDD93109360A3C74CB82BCF0A6A39B83CC9D174526ADD738A6925AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240633, "uuid": "1d00a606-80f9-47ba-9f7b-e130adf3b68b", "value": "384:MSfZrQPcpZOnJ7tKrjPjvGLzcBPkYzj/K/lDXumasir/8gWVUT8Syj:D8cv+2bvG/cRzm/Vum28gWVUT4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240633, "uuid": "745e427c-6f7a-46a1-8ec2-0ebd00530e54", "value": 21576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240633, "uuid": "9f590015-b9d7-40ee-9fb9-68ca173f4ca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240633, "uuid": "636b7bd1-d21a-4679-ab94-73694a17833b", "value": "brichs.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ca5980-c25c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763236283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236283, "uuid": "376024a4-008c-4492-b9ec-acbe50e1cdd4", "comment": "Malware payload (Mirai)", "value": "f59b0ab5fc86a77c03447ca07287bf01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236283, "uuid": "bceb8f2c-b3af-4c8c-bc8b-83d743482166", "comment": "Malware payload (Mirai)", "value": "294814a87218ec03391b6058d0dd85af055a08a66ab74aa9ca8b3464c46b95a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236283, "uuid": "7a93f0ee-eb2f-411e-a416-7e0b17b4bfd2", "comment": "Malware payload (Mirai)", "value": "a7f720530495477445db53e19a50727139f38cfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236283, "uuid": "1eec87e0-7c24-4b60-b480-c21549e12c9b", "comment": "Malware payload (Mirai)", "value": "2c28de97254ee91fe9e4ee10cf1efe86566328296ef27b4e23a6edc60aca1f319b8b2d32585e497d00a6596dbb798062", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236283, "uuid": "e7e5a09d-d836-40c0-8b5e-fd002b2f6708", "value": "T1EDB36DC9F643D0F5EC5705302176FB37AE72E9BA2328DA83D3E89A327C11641D456A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236283, "uuid": "5130b767-2c2a-4fdf-ab1e-2069075d5132", "value": "3072:CkUEooY+GDO8hUdxLnjuU22mRs4ZCaBT:CkUEooTGqJ/R34ZCaBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763236283, "uuid": "3efdc351-d3a7-491a-9f95-c08d28ee3909", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763236283, "uuid": "edadea0e-2d76-4642-83d6-0c696aac9d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236283, "uuid": "ea2183ce-5ecc-4833-9b0a-0daf9c32186b", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfd179a-c237-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763220454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220454, "uuid": "fb7e5260-2965-4e38-a4aa-bbc9efafda58", "comment": "Malware payload (Vidar)", "value": "0802fe0ad8fcbfd71b89f1a3b883210d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1899", "colour": "#81BD95", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220454, "uuid": "ca8cde0a-1ef3-44d8-9979-69dfa5ea37af", "comment": "Malware payload (Vidar)", "value": "294b5cc673d8e3386105c30ea485329763028c4f050ed14ec23934d931f12603", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1899", "colour": "#81BD95", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220454, "uuid": "a717207c-441b-4ff9-8a39-8ae71e089fd7", "comment": "Malware payload (Vidar)", "value": "a09823a034dbfcc82342da1a6d3dd53207a812a3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1899", "colour": "#81BD95", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220454, "uuid": "9cda4f66-af1a-4b08-a89a-95fa43673620", "comment": "Malware payload (Vidar)", "value": "eef05a2e45472c00d65f4724a9b7c88883a340c972798868988129fc1c40059370b806993fdf62ae2c685d7024b46b6d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1899", "colour": "#81BD95", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220454, "uuid": "7bb148fb-2b5c-499b-9ad3-e303aa27d833", "value": "T11DF5335769267806CD31D0A8D22405EFF886F1EEB59697FB3DFF24563B0E888021AF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220454, "uuid": "cff4d79d-06ae-49ca-bfaf-ff1cffefc4ad", "value": "98304:XCcHEEld52T+fVCI5GH0pXkf9ANaWshyu8MCiXfHLr:XCcHEEl1fVCIYf2shyueYfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220454, "uuid": "7a23d196-5e1c-4da5-87c4-0859b4002307", "value": 3596307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220454, "uuid": "774670fb-df24-40ee-959c-c33f0fab7061", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220454, "uuid": "6b5493e8-168f-433b-a61d-24be8b05d472", "value": "file.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d56601-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230507, "uuid": "b8263716-a0ff-4c36-843b-eca20c5a4b4f", "comment": "Malware payload", "value": "22adcf10ec7fa35e551e60caf4a0e3ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230507, "uuid": "18c7578f-73f1-45e2-9d1a-d14c86c0e8a3", "comment": "Malware payload", "value": "29a30c5a4983dc203ea3f287a793d703645ecdd6171d2f788546a43c26e7e294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230507, "uuid": "0db4e471-835b-4e1a-baab-ac9981f50df1", "comment": "Malware payload", "value": "4f958bf933b67795f356e20bb6e3e072523c4f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230507, "uuid": "38278e4a-4ccc-4bf6-a86c-d2d8ecd50e54", "comment": "Malware payload", "value": "fd6303f876fcd2959c32b16db861daf2774b20e0e9d8ed75ae0728628979491a8653abf305b3c6eac9c34970e79a4ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230507, "uuid": "7b57a770-21fa-4787-a300-8e3fc29a0bea", "value": "T13185BF5AA7B410F9D9B7C178C9964607EBB2B8561760D7CF03A08AA61F237E11F3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230507, "uuid": "8713d295-d6e0-46b9-bb8b-690bed814dd2", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230507, "uuid": "e2f0703a-6d10-45b8-8079-de200e76626b", "value": "49152:uGCi+BkxSMDaAtKb46SymE2PEC1ngvVH20vD:ulvIDaAtKb46SyrC1wVH20vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230507, "uuid": "7e7b05c0-f808-4f99-a025-1996edc0af5b", "value": 1778516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230507, "uuid": "538bd9cd-32f1-4bb1-a082-1b582585a128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230507, "uuid": "0c9c02c9-9130-4b19-86cf-416504f357cb", "value": "0idd5dh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2544ef87-c25f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763237435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763237435, "uuid": "366710ef-b5f8-4303-9a82-71e647eb7344", "comment": "Malware payload (Mirai)", "value": "48d1b4e2e545dda670ee24d8bd160f47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763237435, "uuid": "0aed48ae-c3e1-4a42-b735-95baa8091fb3", "comment": "Malware payload (Mirai)", "value": "29efc9247da201127dcb3eecf8bdb338bcaa1f5733b7f21e4fb881b3101f5287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763237435, "uuid": "0eaee489-2381-49d3-b638-b50c57fc1987", "comment": "Malware payload (Mirai)", "value": "e24fd5adabd9aec4c18325e915072144455b2d04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763237435, "uuid": "cbdd1cca-4ec7-4aa8-84fb-e1329a04e498", "comment": "Malware payload (Mirai)", "value": "38e970b8264df6a28a571c1e0c3fc9eb0641bf6c3bc639592d25704d937f2f2c20fea1847712a56cf8e49ddab2c27d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763237435, "uuid": "84cdaef2-3217-4343-bcc1-ffa18f5d11fa", "value": "T14F33188AB8029D3CF91BE6BE54164E09BA3067C151830B2727BBFDE37C721A45E12DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763237435, "uuid": "18ab6e13-21b4-4eaa-9ef7-2528f2b2abd4", "value": "768:cPHHrPhetN+ulD9qthwfI6rTA8LmJCvkHYep4KPb8onDFbNGz+:4rM9shwfI6/A8Lm3MKPbrnDSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763237435, "uuid": "2f6fb49a-06ee-4ea0-813e-51b7d6ae6fb7", "value": 55088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763237435, "uuid": "0d403a55-bc1d-4939-b6aa-89014f042aa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763237435, "uuid": "a50e1b0b-2b5a-4cc8-bf20-f7c5c2cbc8ba", "value": "brichs.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82423f1b-c1ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763187340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187340, "uuid": "8c0989b5-3486-4526-803a-715314e94aa4", "comment": "Malware payload (Mirai)", "value": "819295c34193de408c2c862ec26404f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187340, "uuid": "bb6950ee-d65e-498d-b9b6-e3b0d6714399", "comment": "Malware payload (Mirai)", "value": "2a4fd938bd2a830b2cc424560debf898e0f9bfb9054c401097c0f2d6e91fa121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187340, "uuid": "89c3e613-ce8f-4ff3-abd8-e3a468a5c703", "comment": "Malware payload (Mirai)", "value": "0ea610081e761f152837a4a23e7348bbb2b7efc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187340, "uuid": "de91f479-7eea-4658-aa13-cf315883ada2", "comment": "Malware payload (Mirai)", "value": "c4ae274a649441a1fa42226e3b9809fe0263f831e27156a35ce26152fd9bf8a9483b5936db4fb9a8effe01bc132d740f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187340, "uuid": "2a251d8d-4681-4e32-8679-babc4cb953c5", "value": "T1BEA307C0F98B81F7C00B88301066F63FDA32DDA95171D65DDFAAAF36DA73902961265C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187340, "uuid": "dac395dc-97ca-43bb-bb20-1442190f578f", "value": "3072:d3R509tqQakTyTlNECXoRqfGsBV7+K4vZYYiGU:9gNa7lNEKoOdGxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763187340, "uuid": "b43452eb-4f43-4fa7-b5a2-9fbfad5808a6", "value": 104660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763187340, "uuid": "95a8fdd5-ef30-4e73-b23d-125101b2f541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187340, "uuid": "7ecab549-aafd-4032-ab75-66835cdcbb49", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765a0fb9-c217-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763206647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206647, "uuid": "22b71601-b45c-4db6-a7fd-0dab6b3acd78", "comment": "Malware payload (CoinMiner)", "value": "259af8b201de1cd708f9dce0de9eac2c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206647, "uuid": "0701241a-30e9-4206-855b-416b93f65d4f", "comment": "Malware payload (CoinMiner)", "value": "2ba1775bbb0f5abc6c89f0334cb42588cbd2a5c6903995912611649607c07d9b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206647, "uuid": "23379b78-d3e6-44b8-9a88-0054bb11bac0", "comment": "Malware payload (CoinMiner)", "value": "044b3341a2792161cf3b01847ffb02f6cd04e204", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206647, "uuid": "1f9d9448-1675-421c-9dfa-209a3b3541c1", "comment": "Malware payload (CoinMiner)", "value": "4820913fae289fcc63d4b5c1206b117f97c1aa331781eddb7fb37329cf6618145a3863a2fcf9ec6d8f2491ecd9968d96", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206647, "uuid": "f9ef08be-bcf1-4a0b-9c13-f5ad117d8671", "value": "T165166B99ED0F3D12F3C7F13CCE4A97E0761B76A4E32390B279D25249C59E9D0CAA1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206647, "uuid": "333e2ccb-8f8b-4d73-a54a-2c41d19b2bd5", "value": "49152:7oCA9NKoi6+DPsNhRJE54va873N235Adt1lqslTIU6iXTI:7oCA9NKoi6+wy54R3N235u1lqsi+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763206647, "uuid": "efd47b04-c778-430d-a0a3-8892143c0484", "value": 4269400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763206647, "uuid": "f3758c22-7efc-4bbd-87c2-fcc917fef6fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206647, "uuid": "16b24551-2990-471b-a831-4398fc36a3c5", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b501f45-c251-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763231593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231593, "uuid": "815b067f-63a9-4314-93e8-dfcd5e29de5a", "comment": "Malware payload (Mirai)", "value": "8f80fbed94f127ad016eba270f2696cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231593, "uuid": "782224be-db5a-40ac-bd9d-a9e38d63553e", "comment": "Malware payload (Mirai)", "value": "2bc6b5e3288c310530739ef9b5c6a75eaa5b2273a2ada92e3e514e0dca21cbb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231593, "uuid": "dfa545da-7aae-4665-b6cb-0e5bc8ef48b0", "comment": "Malware payload (Mirai)", "value": "c47cdf453e53b18651038e605e00311d95f8af9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231593, "uuid": "6882a52e-8401-4a6f-a5f8-ee8560a06b0f", "comment": "Malware payload (Mirai)", "value": "c6deb71a98cf1ee286f22473fed4189ecff44b989a28eef3d39a5b7718474a5a29795387c7702c6786c1b2528ee0ba17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231593, "uuid": "80d70213-b738-4b8d-b425-205f98feaa6b", "value": "T1A3535A2179BA6E17C8C4A83A22E34334B2F2174E71A8C72E7D721E8EFF146541517AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231593, "uuid": "6c330e5d-9846-4017-b7cd-6e77ec9bf1ce", "value": "1536:5YA9SYQAA5sp+OZ+mZexrHALkSqHLedei7uhm:55sLqJBIzLedeiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231593, "uuid": "74fde0f5-5f59-4887-8bc5-bc8a6f2c6708", "value": 66424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231593, "uuid": "cf3d7d25-0992-488b-a749-5fc3be5ae917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231593, "uuid": "f995f53c-9bd7-40f0-a2ba-a37847d55853", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642e6d16-c1ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763189007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189007, "uuid": "35d1a5d0-73d6-4775-a309-c94452a82cb4", "comment": "Malware payload (Mirai)", "value": "6b25abd37d1ce8cd58b15d99fd3fb1e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189007, "uuid": "307bec4e-c277-48d7-b465-2169bd536199", "comment": "Malware payload (Mirai)", "value": "2bcc659b23dfa6276939173e02ab04890235c6baa0b770d5591ccbca47755193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189007, "uuid": "c02b20f5-8548-4a15-9ce5-61f5d0847bd6", "comment": "Malware payload (Mirai)", "value": "b24a85239249a07926a5ca68d4a3193f32294b02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189007, "uuid": "9564bebe-a198-4e62-a035-d8e9669a48b6", "comment": "Malware payload (Mirai)", "value": "0a2c7b412362f13bfea9814031140a891bb64f60d1744c02ca45885489c7243663d4ef3841fd1385a7798fe13941d9fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189007, "uuid": "52c23e04-d257-44fe-ab04-0bedc4caa6ca", "value": "T13123F137B3339916EFF020B48C685D8A2FCA0F72D00FB4236E0555A6B59751329D689B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189007, "uuid": "9ed9d923-9901-41b9-9cb6-15a1e5793e6c", "value": "768:aBOLHpkdPmrngmd3iDcRJnoH8hG/zH06hwOuCB/8v5SnF5HfIYc2bvTtSHIcV9qL:aBO+Vmrgmw8eARCB/8oF5HfIYc2UoxLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763189007, "uuid": "b0b6aab7-0e48-4b65-953b-e70cfdafbe15", "value": 48380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763189007, "uuid": "d8154a07-d8f5-4485-a0fa-203a3629e9de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189007, "uuid": "ea152ae6-602c-4b47-a15c-672c5a4ad4f9", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7813395-c1f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763193442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193442, "uuid": "e12ba0aa-b3ec-4a8c-b9ef-1f476dce1381", "comment": "Malware payload (Mirai)", "value": "de286b3b765275a53a8da092cb5743c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193442, "uuid": "a27fedf8-a245-41eb-829c-3b3cff83aab9", "comment": "Malware payload (Mirai)", "value": "2cc524c64207ff66b28d14f23da1bbd9e9c0c6fc5f42023f657b10ac4283cf92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193442, "uuid": "d2213f11-feee-4648-bf67-70da6b71349a", "comment": "Malware payload (Mirai)", "value": "606039ab5f1d0f993e95ec2f306f4bd7fb79ae93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193442, "uuid": "d3f44014-77d3-44a3-be5d-8646c567aef7", "comment": "Malware payload (Mirai)", "value": "99e7335732dbbf96217cf3dc5ea048c031f1452eee169fb41bc1e178e3c400952acbaa1d0b00293d58def948f6443f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193442, "uuid": "97dddc14-0ed5-4f04-a1e5-7b197a932375", "value": "T11B23E1E3B06FDA6BD4B5C07D099D0684EDA53A16837783FF566414F39A32C835C32A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193442, "uuid": "7b31b8f1-0ad9-451a-b70b-15659505b2d3", "value": "768:iBJV5ERuF/rntnIDxXNjPpQs3UaWyiD4hS6UlTDMcznpJkivzEWt1zx0/V:i3cRsTtgPKaWyi04XlTDPnp+0EWtxwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763193442, "uuid": "008b54e9-2840-4348-a513-1d208dd12c4f", "value": 45744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763193442, "uuid": "21db5823-bdc1-4ff1-9c87-e2133c7f7d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193442, "uuid": "87be994d-86ce-4b4f-bea0-0d82e74a8ee5", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f01578-c207-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1763199751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199751, "uuid": "b729a888-5909-4e17-bfa2-147b464960a6", "comment": "Malware payload (MaskGramStealer)", "value": "09e7aac973ea1386c86a776c4c6efc44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199751, "uuid": "244392d8-6840-4d6c-a805-3c1daece9f72", "comment": "Malware payload (MaskGramStealer)", "value": "2e3fa76a30030172e0d76c139f4fdb970a166b8d59f43c4e500c9a3521214ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199751, "uuid": "06ec1af1-e1f8-49cc-b540-e20fc23bf25f", "comment": "Malware payload (MaskGramStealer)", "value": "c9de5500a6da875590bd9f4a647aa6660387c15e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199751, "uuid": "ac67e248-c234-4e0c-b515-6e192fd3a140", "comment": "Malware payload (MaskGramStealer)", "value": "74eeba013d55e850b72aed729e16ef96a975fe32330a2fc57cbe67600ab918b59fc9a749f6cd0af8e7b366ab21b0d492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199751, "uuid": "32b437b6-3811-443e-bc73-5f9997eaa341", "value": "T19DD312AC6C58A4CCF3398BBA2C147B795F30DD23D38FA99E454762690D87999B31C702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199751, "uuid": "8c09c8dc-20a9-4671-b0f5-0e55d3cfd8d3", "value": "af83b26e354bd634b6a8028b65c0a61f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199751, "uuid": "2d6f5388-e6c8-47df-9be5-7e251aef483e", "value": "3072:feSych6MWiDG8UbTNthSbbLpck9CD2P5FElK0KY:0MrWiSdNthSbxu2P5F70KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763199751, "uuid": "f1159a0d-e37b-4965-be36-e9c3bc66683f", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763199751, "uuid": "3a64f088-6b48-4394-a264-5631cd616a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199751, "uuid": "9c36f551-10e7-4325-8eff-5c6bf1e4ad88", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ba67fc-c255-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763233300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233300, "uuid": "2bbdfc19-5bce-4f70-b8e5-7f57b3e4557e", "comment": "Malware payload", "value": "c84a6ddda948cc4d924323834022e7c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233300, "uuid": "34aa9c93-5367-4d93-b3d0-89c01d8fe04d", "comment": "Malware payload", "value": "2f8b0e971474e0f90648010e79c5e7aa401f1f4e23440c10a5e09696ce8de3ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233300, "uuid": "a3e8d0b8-7aeb-4aa0-a90c-75cc0780a083", "comment": "Malware payload", "value": "3899fdd44a176c5d7aa8895fedbc4cc6d03ed949", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233300, "uuid": "33e496d7-52d9-473f-9a96-df7e58dbf714", "comment": "Malware payload", "value": "b1c6eba68f0cda397ed956bebce20dc77b18802fd54b73cd5a48286f305f24a4303dfeb9e348bcfd86a2f04b7e2b596a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233300, "uuid": "d72c3f0b-b4e0-48f4-b0e2-54e631ec541b", "value": "T15BE0EDFA84111D263008DD85D0DF00E0723E6FB6C268DB9AA25F3E2D63CC7103C61D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233300, "uuid": "40491789-dfa2-4a34-8545-4ee5910ee783", "value": "12:AaaoNNA5alheNA5a9NI3qNAzaWfJAKoQ2:koLAtAKNIGAzgK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763233300, "uuid": "d31098bd-9444-41d1-b081-3c3483ad1c5b", "value": 412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763233300, "uuid": "4e6fa200-198a-4ab6-90d8-8ae8a4491d85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233300, "uuid": "61b516e1-9223-473d-9dfa-a178efe24862", "value": "res", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61f3050-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200714, "uuid": "5671e26a-12d4-44ad-a817-28d0fc8b82c7", "comment": "Malware payload (Mirai)", "value": "3a66082413d84e631cff826fbe093484", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200714, "uuid": "aa99e23a-fe77-4260-b63d-442b9415b5ea", "comment": "Malware payload (Mirai)", "value": "2fb1416b55f9af27d1ac4e517a8ae53bd2a7a8340e69ff758664a575aed9311c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200714, "uuid": "5189e03a-863f-4bfa-bfa8-b962aee47e2e", "comment": "Malware payload (Mirai)", "value": "0b29244131abc014eb5d2038c72e1b59e8f13683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200714, "uuid": "8bb20c22-5e8b-4a8f-94be-b366582e8a1c", "comment": "Malware payload (Mirai)", "value": "87d402b2cbe813cc7a523bd6f0e74e4be5becbfd23529508b66bc9b15304b854f7f5076b038a7728cb343292ab6878fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200714, "uuid": "a71cd391-33e0-44fd-8f79-7262cbd40125", "value": "T17273AF76F4142CE6CC421AB8B5B4C9B80313ADA515A53CB26F8DDF56087BBE8F14DB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200714, "uuid": "22f8022a-4a64-4b24-a934-86dfb7cffaf2", "value": "1536:jaatTOaqdyAXbkbtj2JC0TLHNGqrk/uP39rfr:jzKaqdyAXohGrrNG8rT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200714, "uuid": "1e549164-081b-4cf1-af4b-c7520594e2c3", "value": 74696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200714, "uuid": "b1613fc9-b38a-4d7f-91af-95edf8e60476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200714, "uuid": "2d5e074c-5069-4a0f-a83f-672c1fe02a99", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd87197-c268-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763241341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241341, "uuid": "ba00ec4c-7d7e-4c2b-a92e-de433e47c6e6", "comment": "Malware payload", "value": "35f83371a8b50ae5dfa5f79c023e534a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241341, "uuid": "3466cba3-fbb7-48cd-b91b-e22fa070e231", "comment": "Malware payload", "value": "309e492c17a1d7fd2def602262cf408ab5c04219f9d411438309764a365476a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241341, "uuid": "4e48c6bd-7b63-49e1-8f24-a755876fab8e", "comment": "Malware payload", "value": "a0010f08fc851b385e556df65b35d7b84aaff065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241341, "uuid": "c00f22ef-2060-4291-8ad4-d5930fe5fefb", "comment": "Malware payload", "value": "cbc7b63a60ef996c391570d603418922b1e10762ef65067d9679fe572c52d92a38f5d167ba47430c0db85037243e7032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241341, "uuid": "222915b1-577c-4292-be9c-0e8d4c7e7087", "value": "T11A064A176C914AAAD06AE238CDE245B27760BC0D1B7267D37E207E7A1E777C0197272C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241341, "uuid": "8a1c04eb-c750-4ce5-befa-c9c05dd44801", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241341, "uuid": "03ff5d31-22dd-4e27-b866-b878817a6f2f", "value": "49152:agZ1jVex1UnT1Khw9CFPmt6YM408RwCw0E:aWT1Ka9UPmtzJlw0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241341, "uuid": "00e47be9-f593-4125-ab2b-4c7bc130e103", "value": 3843592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241341, "uuid": "16c22fac-3238-4618-b60e-1dc7e11d0855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241341, "uuid": "8422c8ed-3dec-4a02-b0a0-ab463bc5672f", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54eb9e6-c1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763186137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186137, "uuid": "856f6bcf-74a8-4b3c-be4f-d3dd40175045", "comment": "Malware payload (Mirai)", "value": "70bc44da1800f6df1146362baa489e7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186137, "uuid": "0f48daa1-a9ad-4bf1-81be-4f5dcb5f879a", "comment": "Malware payload (Mirai)", "value": "310d7356766cc6a0b637c04c32ec76a8c51e094aa97303d1f8a367fd0dcd401c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186137, "uuid": "05d29780-8d07-4173-8dd7-09ff6b88a19e", "comment": "Malware payload (Mirai)", "value": "9f6375acd48dc04c754395f0c0df22411dd59ac7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186137, "uuid": "02844673-9622-4d68-998b-04cc4b7d9117", "comment": "Malware payload (Mirai)", "value": "7fe54cce87adf6585487fe9efc33cd635fb303481ee27b268ee3383fa5bb49275c01cb4b8259651b0785cac46fe4af2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186137, "uuid": "46589337-d28c-4c38-a3eb-db9482145ad5", "value": "T146935BD4E643D8F5EC67053611B3FB3B9E72F5BE2128DA43C3A49676A813541C40AABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186137, "uuid": "6864f4b4-ce4f-45e4-bdd5-f831672e93ec", "value": "1536:h/OdTxWwHAtlFodL9gEJO7TPV0PtdHFvqZQcxrrwxFy/vZSiM:BQT5A49ggoTPVAt1FWQeYFniM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763186137, "uuid": "1dc19bd5-f8dc-412b-9257-9c83abb2a6c6", "value": 95508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763186137, "uuid": "b807d523-39f9-41a3-81dc-fce6efc91cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186137, "uuid": "43037ae1-d738-414b-8467-d1e128c827ca", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a546c559-c22b-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1763215316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215316, "uuid": "2a0e8d84-5faa-4add-8606-c37e5d8cf8cc", "comment": "Malware payload (SheetRAT)", "value": "8b2cb4d2384f41efedd6035efd4ecbb4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215316, "uuid": "83c4f98a-34b5-4abd-a695-20ae4f117407", "comment": "Malware payload (SheetRAT)", "value": "31cd0a970953310b8cd8a5418eafb8a992e530cdb62ff19ddd72e15338e7ef71", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215316, "uuid": "eab8cac9-1cd6-4c13-b3c0-2f2484f6ca39", "comment": "Malware payload (SheetRAT)", "value": "7bc7433aab61f05f005756291e17d2d9def31e0b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215316, "uuid": "6971d52a-90ba-474a-af42-f3104f123e17", "comment": "Malware payload (SheetRAT)", "value": "ffa5d934f149439d7343054e8565f4b793c8912bc719fe62eb28b576e238fcf699b565f0c6fe890e62afb024f14337f4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215316, "uuid": "5bb2f6f4-6190-4402-8b15-110079cd4f9e", "value": "T1A6E4A20CBD51FC14CE6E3DB38BE690A11B3210C63F22A116335A6EF95B593B649A317D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215316, "uuid": "87a4b89b-ff7d-4bbe-a86e-4a53b6304b49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215316, "uuid": "2bff2dfd-fcb9-4c83-9754-66992f9806fc", "value": "6144:0JBVJc9zxaAhR+h0phLLWzeZmccJInzMJdHmF3r209Dx1NbsECsD35EhDmQctnzh:0JPJghhw6pJftLm83/KECsb5xzD5p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763215316, "uuid": "2af2de55-f9fb-416c-bcd9-8ec54893636b", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763215316, "uuid": "755d0330-bff4-4697-8a43-5a3a6a1d8524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215316, "uuid": "30d899b2-f962-4337-837e-4901c94c07d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5bd560-c264-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763239889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239889, "uuid": "23574eb2-ca48-4e6a-9072-5ca04ae2ebc3", "comment": "Malware payload", "value": "af331fbf38a20d3bba5ae963e8b59746", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239889, "uuid": "e7d52718-8c3d-4a7f-b948-6cf99a0603b1", "comment": "Malware payload", "value": "31d169de654f9bf8ddf5bc22428875424fdf4f3bc8182c9005beef5152a7d2be", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239889, "uuid": "ba3d1fd5-1f20-4dc1-8786-c8a3289dde7d", "comment": "Malware payload", "value": "463f48be005c05e73b8306be9c10720e190b5299", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239889, "uuid": "5d6204b3-2709-4adf-b8eb-c8bd0540cdf1", "comment": "Malware payload", "value": "7835ba5955471b4ec500f8361286e49e402a1a4dd737793356942517b64184f8c43e18b0661f5f600af5a66f6c7197c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239889, "uuid": "9cb2ff25-b9dc-4c1c-a75a-1151aeb81933", "value": "T10011BD9DDDC2E992C425590C70C7C14CB053C3DE2AD38E59EC1D2A6938CC849F435B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239889, "uuid": "b0fefdd4-3094-4ebb-a95d-6b4271633331", "value": "24:sEqoWBGhBh9Mk8QoWG3p2VGXO/I/V7NGIkoZX9lHp:sEqoGGhL8QoWGIVG+wV7NGIko19tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239889, "uuid": "48234ad8-7d54-4c28-bf3d-cf7a6c7fb585", "value": 948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239889, "uuid": "45cf3d0e-8e32-4eac-83bc-8cc43572e3c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239889, "uuid": "f61198a5-c170-4761-b26a-07735d8995be", "value": "k.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c787d6-c217-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763206535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206535, "uuid": "4691fcbd-e44e-461c-8d01-1aea148e5c1f", "comment": "Malware payload (Stealc)", "value": "23b52dc13e6eb59ae2e5179995449fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206535, "uuid": "45f87ed7-95b4-4c50-9cf5-506ab2109f60", "comment": "Malware payload (Stealc)", "value": "33007149b2e210384c82ebdc51994db576e71149c39d43dd46cb973c551eb21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206535, "uuid": "dd10fff4-1d89-4f3b-8915-ca2104890f10", "comment": "Malware payload (Stealc)", "value": "42e7c0de8b314afed5c8bfb3659384f6b8b4a02c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206535, "uuid": "29034447-d639-4ba6-90a3-df993fedf5b3", "comment": "Malware payload (Stealc)", "value": "b3f07048b674bfc12f799c052cdf7b7627ddf7d66e00d42f2f1e94713a528b4e678270dc1b4657cf3d238e129a6dea0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206535, "uuid": "896d8247-ae25-4419-8cae-1c26da1e11d8", "value": "T1C1C49E02B640D4B6E4770574CD74AB249BFEBC700BA15ACB63C01DAA5E716C1EF26B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206535, "uuid": "fd34b32d-fc83-4eb1-b0aa-8a4b323b4a19", "value": "142742dbf9c32803f23e9bf4191577a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206535, "uuid": "443d2baf-ae65-4a11-b344-7b924931dec5", "value": "12288:eeEcWN9hWQ/vNJR/0x639fqqv3YZtF15kjHP8AT:eeEcQhWQ3Rb1q+3t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763206535, "uuid": "a56565bd-fc00-4928-a297-2fa6e4546b4a", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763206535, "uuid": "95b5242f-0fd5-4366-a550-0205df10b8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206535, "uuid": "3f914208-86ea-480f-b88f-f95165d6e1aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402a53a0-c24e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763230178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230178, "uuid": "d68ebcfa-8852-46fb-b9f5-ff3423fc4962", "comment": "Malware payload (Mirai)", "value": "0911e9d114d70a9f51e608f73c0f3d4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230178, "uuid": "bd85aa18-0c0f-4a55-9a6b-4ad2e3efea84", "comment": "Malware payload (Mirai)", "value": "336e2620423e582abe2a9408f90011908c17c7e1378dbfc09fdad5a363d2bb80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230178, "uuid": "49776f38-4828-4641-b7e3-d45e9592f043", "comment": "Malware payload (Mirai)", "value": "e826ad6954bc68769014e22c94b0d5e42965b6aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230178, "uuid": "f154a591-4d5e-4377-8af4-5fee506e7e86", "comment": "Malware payload (Mirai)", "value": "e2c27285fe55577e604cb392ee6b4fdd1034cd286525e27555069208160a2fbd7273de5c1abce546904fbec29b0d28f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230178, "uuid": "85041045-6e70-4dc0-bad2-0e31d2175694", "value": "T1DA433BC4E643D8F5EC05193528B6E7725A71F57A1058F993EBDADE32B801E01FA0B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230178, "uuid": "8990ae07-5dc1-41c4-bc28-d0994e6607fe", "value": "1536:50iugWmoVo3CXdgyIJP5dq6neuGtRBzGHf1JevwIzGUdbRR:5x/1oVo3CHIB5dq6OVzG/1uw8zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230178, "uuid": "47d56dde-c313-4d7b-8ae0-06c0d0381915", "value": 57984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230178, "uuid": "188f0f0e-a676-4326-9f63-e8c60590164a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230178, "uuid": "eb56ed71-dc1e-4d87-bd24-504a7cb840be", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5d08cb-c24d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763229793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229793, "uuid": "69865b9c-a9ff-4527-be68-5d195ada60e1", "comment": "Malware payload (Mirai)", "value": "ee0445cb22f76b7203599a6e8a3b8696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229793, "uuid": "e69cfac4-7129-4f7b-8929-0d65661292ab", "comment": "Malware payload (Mirai)", "value": "339c1625672fa383909188bbfc592d61155b357444b4afa28ce11cd4d3afeebd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229793, "uuid": "334b8f23-5ecd-4b25-a205-4d5f972bdc21", "comment": "Malware payload (Mirai)", "value": "8b7b2574495b51faedd59a3b02e33d6a1be6e3ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229793, "uuid": "6d4ee585-aab1-4594-9deb-a22dab52f08d", "comment": "Malware payload (Mirai)", "value": "9991800545c77c062f068a5325dae8481ce026cd253ef840c12f146239bfd6c483f3c4c3b801994d614b317305ee7572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229793, "uuid": "1f36ffc7-27a1-4e08-bf22-d9995d413090", "value": "T1E1B3E085B210AE55C02672FCB187099093B17E7B4B9A150B4473F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229793, "uuid": "912c6261-eb4a-4099-ba74-a170d241a10f", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wux:as5zqhr5Nzy7wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229793, "uuid": "f7eb244e-2835-473a-9882-6de5f36cb5ff", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229793, "uuid": "6cec358d-985f-4d00-b803-b96bad44e75b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229793, "uuid": "933ff12c-c950-4ac1-b0f6-684807194f1c", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacc7a42-c24d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230008, "uuid": "8e7b1998-c5bd-4722-a694-38cf8d626202", "comment": "Malware payload", "value": "9678b3f19a1b03390b473d724d9cc85e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230008, "uuid": "7bb94a4c-2c82-4450-a216-d6355f65e38d", "comment": "Malware payload", "value": "33b01253db889904fe50103771ff248d6c836098917b20554cc5bce967be7c9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230008, "uuid": "9f6ea96d-9b70-41ad-87d8-bbf91e74f5bd", "comment": "Malware payload", "value": "16d418a57d66b40a9eeca29fb3ffa250d513fe1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230008, "uuid": "123e810a-c310-43c2-a9fe-5ce9a0d0a909", "comment": "Malware payload", "value": "5b58f8cc322e6c7c1b2377f7582f482ff12520c0d709d714a36effd140b8da08a097a6a85c13560548b374275a4737d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230008, "uuid": "a2a4fe2f-79ae-44b2-ab73-6541d05e353a", "value": "T175183321BF85B50EC49DB37D6EBE226408CA65474CB0BBEE156BCD8EA5FC9705324063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230008, "uuid": "9a0be21b-781c-40e3-8d3f-039b6db3a971", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230008, "uuid": "5688ad7c-d363-4243-a57b-0f8a9eddd388", "value": "1572864:I8+BWMFDe45kbNao4NBmDYjt6hDRxAcdT2LR7BHITe7o9z8bx/SSb9Nb9h7aO2d5:ItBFle452aNBghDRxAET2LRV7o9U6SbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230008, "uuid": "ddee900c-6e78-4347-b3e1-b7835cd27376", "value": 87943836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230008, "uuid": "ce829b29-c333-43a2-a454-47251712352e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230008, "uuid": "16b29850-e30f-419f-a996-d8dc41b56d67", "value": "Everlight Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db64123-c1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763166126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166126, "uuid": "7fb75769-04bc-4b17-93c3-f320e85ba057", "comment": "Malware payload (CoinMiner)", "value": "62802abcae18d915a106788308192def", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166126, "uuid": "faa16071-26a5-4178-8616-e4d89abe0c34", "comment": "Malware payload (CoinMiner)", "value": "3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166126, "uuid": "10ac0a48-6402-45a6-a70f-c7e0691fbfff", "comment": "Malware payload (CoinMiner)", "value": "3273d875b4368d38f6b735b020011c19118d600f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166126, "uuid": "63105526-2392-43de-8851-b46741ae9799", "comment": "Malware payload (CoinMiner)", "value": "56207fa51d89a09e1284da7d7cdafc39350a391a81daabfba7245c32024e9f4bc8d5742182a5abbc2a91bced49e494b7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166126, "uuid": "e37dd7dc-8ac0-4d40-82cf-d3540b673e0d", "value": "T1E85533D67B8493DCC13CF099E908DC283CECA9248F776D04DE5148C63667BB58A58AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166126, "uuid": "68569286-bcee-454f-bb36-d9e705d96219", "value": "24576:yaOwVvvYm3CwpbTqfb2tEZYclsK21F9vJLESiWiV5:y3wDTqfespsBfxJM/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763166126, "uuid": "e45a43e2-7ba6-428e-ac14-9a29f72c176a", "value": 1299516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763166126, "uuid": "e8eae961-2d26-47f2-8449-6841013bf006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166126, "uuid": "d1ff1dfa-ecad-4e74-9162-c5da92017153", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211d7ef3-c259-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763234851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234851, "uuid": "3ce19fa4-6a5c-4c90-b9b9-0912a59e5a7a", "comment": "Malware payload (Mirai)", "value": "6aa151665c2bfc6ec1aadcfbd39b6183", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234851, "uuid": "94282af3-f878-4674-96e3-2742ad8ea2be", "comment": "Malware payload (Mirai)", "value": "37dd8e2f73ccaef104bb88836dbdc7faa805fb5665fbb01e3d5954bf30b0a66d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234851, "uuid": "01b5438a-80f2-4e4f-9fb7-b933db7e9f41", "comment": "Malware payload (Mirai)", "value": "6b633b4efff0d210698f8894af3622c9b4844512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234851, "uuid": "c8bb74f3-99dd-4d5c-8c40-f508a4cd94a7", "comment": "Malware payload (Mirai)", "value": "55313cbcc6b476f47ca22a48e4f4119d1efe27628a910d6d402f845ad44b1405803dcfd575d8187e2bcdf44edc82035d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234851, "uuid": "2f8dd104-df5c-4cb0-9e27-2e366b6f109a", "value": "T180D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234851, "uuid": "72526cca-75c2-44ae-b137-6d17725e4960", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0ZS6:xOFgpOEoVv3MXL5NhGOS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763234851, "uuid": "b02908fc-b906-4e98-a336-3b87227571ae", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763234851, "uuid": "fcd73aae-eb53-4d80-80c5-60e8fe1869fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234851, "uuid": "71d86e92-269f-4cba-a689-51e06647ab96", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344de501-c252-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763231876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231876, "uuid": "2bb83050-5e52-48ad-ae62-54bfe284dc8e", "comment": "Malware payload", "value": "d1f2b8e7b8e8c42a7507fea917b5719a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231876, "uuid": "08bad7ff-b584-406a-b123-2f1e0aa2243b", "comment": "Malware payload", "value": "38a03d16be9da16695e2a286948482e2fd9ca8f303213a8f6ba1ab10627fea8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231876, "uuid": "cc618119-dc48-41c0-8f5b-d6d816c8f2d4", "comment": "Malware payload", "value": "e21885085b8de568815890f072509d0af9dd47ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231876, "uuid": "39e6bcf9-27df-4b40-811e-a0e5e9bf254e", "comment": "Malware payload", "value": "e841318d670040e0ea4f71c469d81cd1524961438051a8adb5679e9cc923dd09fef17c5d36ac9b8e5d637191ed216875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231876, "uuid": "a49f4f17-9769-496f-95eb-6af0ae0842cd", "value": "T12718337A1FD7C80FC056757B8AA936B155E354632E21D03F6256C1BCB8ECE328A3524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231876, "uuid": "2037c4bc-bd2f-4fc1-9033-a82a83adadd4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231876, "uuid": "8a1c3d12-1710-4d98-85f1-8d9359f092f4", "value": "1572864:Jv+BWMFDe45k5yr46hDRVO8GyD1KWHsPKhwC8coHhdXmaXALwpD/n7aCU:JWBFle45MWThDRV9BKQ5wvS4pRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231876, "uuid": "f8db9b33-8fb7-4146-abdb-ad86724e67ec", "value": 87920695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231876, "uuid": "9440384c-6e73-465f-a651-e3649984d742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231876, "uuid": "fedb5288-2d75-43d7-8d34-f7aa25ebd085", "value": "vrchat Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94719742-c251-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763231608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231608, "uuid": "4bf408ba-bc7d-4c22-8acb-751b8d850211", "comment": "Malware payload", "value": "89e5657e596405a6b4d7fda18c46a333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231608, "uuid": "73e84d81-8340-43ed-81f3-01759a96b65a", "comment": "Malware payload", "value": "3961f676f721bbcd5322f3bf97ca06a5a72941675a8c5012ecb4527cb78efa2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231608, "uuid": "00106a21-7cfa-48b9-a70b-7b1e1fdf4442", "comment": "Malware payload", "value": "875f0580b9b5abf6dd80c69f6c544f33ed4551ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231608, "uuid": "f6eeb937-736f-49d5-a154-1cbd344902f0", "comment": "Malware payload", "value": "30f7288c12b81dc7f5e1f2fcd2a2f9cc7c6b4fdcd6ceafb2380a460edcd7deb75ed1895d4c73848c11005c93521c5eb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231608, "uuid": "966cd705-bcdc-4cfe-aa2b-291702c71604", "value": "T1F3E3948436B4FA5BE0262B3484E729E147EC5AF61BF0E5064947C2DDD0111BBBC8DB9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231608, "uuid": "facfc0cd-6b87-4f46-bba1-95f78d2f6311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231608, "uuid": "5cbd3a2f-1eb8-4357-8680-b6de4989bcb4", "value": "3072:Yuc+2wfnPHftJs3fA4APYE3nJsoX2A6QLrrpiTAwia7Bh7zrPqw0SbqMS7n6eHcb:nPjpJD2cLvUTXxvrxNSue8uKFil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231608, "uuid": "d2fe08c0-884b-4518-93a2-b405fac2d190", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231608, "uuid": "25e957f4-4aa6-4f19-878b-385c7635f547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231608, "uuid": "4c767bba-a406-4ccf-8219-2093c3b97f59", "value": "XTS.loder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a8bd8e-c22c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763215875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215875, "uuid": "f7b67daa-121e-4c11-a9e6-ce25aa76fbd1", "comment": "Malware payload (Mirai)", "value": "22f94a4bddc50a6d2899d9599ca0c706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215875, "uuid": "f4956f2f-f62b-458f-a5f4-07d3095bc25e", "comment": "Malware payload (Mirai)", "value": "396dc977342b3155b0ac3ca46b0c4937518f686dcae497ea266b828968f5b2eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215875, "uuid": "7dd8847f-e7e8-4242-bfb5-fb3c3f0d0ea5", "comment": "Malware payload (Mirai)", "value": "39ebd24ed6b2aa17be9cfd35e47dac6ebafc2193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215875, "uuid": "85f397e1-19a7-4889-92c0-2828af2c814b", "comment": "Malware payload (Mirai)", "value": "512fc67289066bf631161df85a4bbd9c8eff12b99db4fdcae4b16b364d9209a39008591013fa69ce8494a74f460a5586", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215875, "uuid": "45d8309c-5a7b-43bc-a022-ed8c43bdbe1d", "value": "T1BDB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215875, "uuid": "85108f82-71dc-41d6-92c7-ef0367c3d85d", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzN8rSR:t3SrlGWnKTU83AQB5A5Liy36fZUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763215875, "uuid": "0c815248-0f72-4fb2-afd6-9dd0f758b263", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763215875, "uuid": "beb5d23c-8ded-4c77-9cf3-d2f20605904f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215875, "uuid": "5e098ce8-06a9-4b07-b1fd-e79e5d79e504", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d319346-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230764, "uuid": "bb67af88-227b-4a63-bb52-90755e9e5d14", "comment": "Malware payload", "value": "c45113f5f7e45f6da9e5ff7a76e1cd27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230764, "uuid": "4abcf05a-ef88-476b-88b8-b1de4fddce57", "comment": "Malware payload", "value": "3b01526973488a237e7e9e0cde93ef68caa72c8a831e58b3fd0719cb07138e2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230764, "uuid": "f5a56468-1728-4c17-bed3-00636c4a51c7", "comment": "Malware payload", "value": "b34e7200d191d32468b53d4dd8e346966e67480d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230764, "uuid": "0c5ce296-5748-48a5-a4bb-92034a746461", "comment": "Malware payload", "value": "628682deece4606907fefdf12dce424765f10481b9aa16a2bf24bbb2722368470b0c68d8e7bbedd0968e14e185645296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230764, "uuid": "c14f699b-19b5-4a1a-93fe-36e18446c41c", "value": "T1AEE1310DD217A6F2CE5A087216DBE5AF6F647E38D4718C41FB604E126F52C2E1A18F18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230764, "uuid": "5363ef5f-71b5-4aad-9f38-29dcd60d634c", "value": "96:Cwf6foVqsk3b8Jf5RaL1dRmGgh8wpE9O79r5x6vMEkY3KzhE/aNtAbCULX:tbN88Jf/+7+h8oEMjxCK1ULX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230764, "uuid": "31bad0a7-57e1-42b5-887c-4d9d9db45c12", "value": 6800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230764, "uuid": "8f801a34-a50d-4528-ade8-9f1d42599d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230764, "uuid": "c8ee0a52-d6b6-4bb9-bbc3-02152debe12e", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.6489.20196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedd9a5f-c22d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763216244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216244, "uuid": "1166f1b3-ec31-4358-81a9-10a8fa4b9dfb", "comment": "Malware payload (Mirai)", "value": "b3741d0046638d8df83836d5b6cf6d45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216244, "uuid": "3cf8bb49-9c0c-487f-ab1b-b67ebbf5e850", "comment": "Malware payload (Mirai)", "value": "3d5617fa63441d14729a39a85c66d224db0d5b7a672cc54fc5e65177fb1342b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216244, "uuid": "7e15ab41-0c4a-4b26-ad54-576527bdb92b", "comment": "Malware payload (Mirai)", "value": "6f19503f4fceb6accd79ebc8e5321dcc912f8b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216244, "uuid": "bddaece0-4c0f-4b3a-8b99-f6d596a77590", "comment": "Malware payload (Mirai)", "value": "1e20fd39158bdd642ed1e1512920a89fce0bee489eaf348b73f56a837b3d39a98b7c0e4b8c5ce4dd397c621d53bf4a3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216244, "uuid": "7b535f53-7d8a-4ab5-8000-0a20a76add04", "value": "T133145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216244, "uuid": "75bed0d1-f269-4020-ba31-a717cc4ac3df", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXuUaN:HZ15BTYCrYq1QDY6b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763216244, "uuid": "d0128d16-1942-448a-b0b3-9ccbbd9a7e02", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763216244, "uuid": "ec10e423-fb75-4695-a332-6c49e75cf907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216244, "uuid": "0d51381a-56b4-41c7-81b9-8ed28809bd82", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91fb215-c26b-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1763242837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242837, "uuid": "5c7d465a-bef5-473f-b86e-e9c0d8d5958b", "comment": "Malware payload (njrat)", "value": "3d6a54bb349515cb28425d0fd0de2dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242837, "uuid": "ec0004e6-8fd3-48f1-bf7e-4c9a15480162", "comment": "Malware payload (njrat)", "value": "3df1c2d8cb6357dec23ffe7083d6058c300419519ee7b34efcfba3a0384ea08b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242837, "uuid": "fbd428c4-1c44-41d8-8d72-844f9d7e84ff", "comment": "Malware payload (njrat)", "value": "cd283b7e3353a18216743c692e2c1c7f2e6e55d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242837, "uuid": "88ca6c24-da6c-4aad-b8ee-4a9e911988a4", "comment": "Malware payload (njrat)", "value": "44c373d679fc6ef5a407d9442f2b5e6bc0184a97b17217e0d9d3c59f3c01d22e1025b1b18e644b7e2ec31f9e89c12b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242837, "uuid": "64d6803c-99dd-4bd1-a7a0-2875c41f68cc", "value": "T17425CF9077F4850AE1FF1BB9E4B148494BB7B8129A36DB4F09D4A0AD1EB3740CE513A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242837, "uuid": "a49a3d18-e62b-4683-807d-78d90e07db1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242837, "uuid": "1c997dd5-76f3-42b6-beb3-53e61a409a66", "value": "24576:kF/pGBxJzck+uGW/yFoBkkAQq7GCQ/MmD1E:kF/pyTYjqqanTuZmD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763242837, "uuid": "c02868da-f334-4dea-8f65-a075f16d4dcb", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763242837, "uuid": "4eeddeab-8383-41c7-b754-0d0b71dda38d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242837, "uuid": "a9e3c265-a507-4e29-ae24-26a656da9577", "value": "Pulsar-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41fcc78-c217-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763206724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206724, "uuid": "64f547c7-3da3-48c9-8e01-cd037da81a16", "comment": "Malware payload (SalatStealer)", "value": "393908d3d6aa75c9de51d1ae590e9fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206724, "uuid": "4e080666-fc63-43d1-874c-c1421befef05", "comment": "Malware payload (SalatStealer)", "value": "3e51487c6dbb2e6aba37331f312e06ad1c43a24786cbfff8db60d6fcf1030527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206724, "uuid": "edd7aa91-dc75-4eb2-9fb6-0a77d19c73aa", "comment": "Malware payload (SalatStealer)", "value": "20a3e6b379634c10b041b40e70945883041f4346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206724, "uuid": "2305e2c0-3406-4a76-ab53-051a013b096b", "comment": "Malware payload (SalatStealer)", "value": "c59648ecbfbb50a751a83a52e24a40f09234e7d9a1ced73e52347ccca2ee77ae4d68d613af383c6cce1edb67395c1812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206724, "uuid": "18071a52-1635-476c-8b81-db8f3db71d9e", "value": "T187F53312FA7D644AEDA0472E7136F024FF9225968288CB97B359183B09D18FB3B17DD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206724, "uuid": "8d73dd5d-c783-494f-ba73-d369075230c2", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206724, "uuid": "a2521c1d-7e9a-479b-ac83-7f4e730d774e", "value": "49152:19DVzIi5bZLx8wsLRsxzQ8M8I75mLtO7IquJBwiM61306DJT2nn:F19ynuTM8RHBw6k6t6nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763206724, "uuid": "7d31cced-9987-43ef-8655-6c90e9a8b0a8", "value": 3558400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763206724, "uuid": "be9874e0-5a49-4b79-b9b5-9f9bee7fdef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206724, "uuid": "50d6098e-982d-4f6c-beb5-9a06077e0c10", "value": "RUSTcheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a1d7fd-c1ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763187323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187323, "uuid": "875e75ff-9c53-48a5-8895-b919cc3c9a83", "comment": "Malware payload (Mirai)", "value": "e49de8eb20a55b3f1d99e008989a83d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187323, "uuid": "5f7376e4-7b89-41b8-9ef3-fbab36e1db7b", "comment": "Malware payload (Mirai)", "value": "3efea980ef9c8c3e6003f97903af0c8b5814e73723f15f65aba3795015b491c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187323, "uuid": "df5f1892-9237-4746-a923-118e7d94d6b2", "comment": "Malware payload (Mirai)", "value": "003d01e6fef0adf6b0846dcc5ba5ce5042edcb33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187323, "uuid": "fb6a097a-cfdb-4c49-b1ba-55c6c2b2fd7e", "comment": "Malware payload (Mirai)", "value": "43324ef04d02a79da81466e9feb28599fe2db4d850510cbf782fb06a5bd560f01e6c6c6c1b06f5e05b01eab14d6d9556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187323, "uuid": "47959d15-97be-470e-9e21-0b940073083a", "value": "T1F013F15AF64399ACCD1755704A2EBC0D09450E2D147CFDE5DA8920A2B2B6F3C3D2C98F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187323, "uuid": "e8821f24-96c0-4c03-b8fd-fff98b66ab88", "value": "768:AZI1h8sKwGKz1mWjoaKbIHGzLg0GNyaes+zKnnOU3pnB49HZUo7Jur3bGEmf7HM9:QWhxgKkIHALgsaesJhpnB4b7JG3CECs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763187323, "uuid": "5c320091-3e1d-4310-b134-d1fe07e97ed1", "value": 45224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763187323, "uuid": "a816b79a-898a-4dfe-b0c9-6b1dbebd6811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187323, "uuid": "97e90da4-10c7-4e45-aba9-78c5b41d7551", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4e0389-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241530, "uuid": "6b685614-3eaf-485d-94ab-f06bacaac6af", "comment": "Malware payload (Mirai)", "value": "268e84ad33017a1627ef6676c6eba4c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241530, "uuid": "a8f048bb-09e0-4d91-a750-486bcaee832f", "comment": "Malware payload (Mirai)", "value": "40547b593a0eefa0a818a539874f66ffa195bb438d5995acf7d06829f707e65f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241530, "uuid": "d0e94945-5e3c-453f-94ad-fcd212044b86", "comment": "Malware payload (Mirai)", "value": "4b4be97c2effc68c2f65b498c1394faf7964fedb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241530, "uuid": "2c25c1f5-def0-4bda-a9f9-9ca18d3904d2", "comment": "Malware payload (Mirai)", "value": "94bcf2b7f47bf9515b723ba802112600a989a4dc08c60212c550fc818b505a035e55296333330c01e66837d09a8ebc82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241530, "uuid": "238b935b-0fe2-4b8b-8b8f-f753726d93fb", "value": "T134730856B8814B11C5D512BAFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241530, "uuid": "3bb2493f-f232-4659-93c4-aa2872923ff6", "value": "1536:2lntExPgXkpdDHkM7kdxr4udn+W48agl00IAiGX3Wv+AcY5sYIW6L:bxIXCdEdU6+Z8aYX3Wv+AcYuRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241530, "uuid": "bca89bdf-864a-491b-ac75-03bec26caee8", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241530, "uuid": "98baf6e6-1201-4638-a180-31844e4c6f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241530, "uuid": "78030506-cb6b-4450-9a1b-443ff2a2acbe", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e8343c-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240756, "uuid": "2992e70c-d9c7-43fa-bfc3-b94b9f065cb2", "comment": "Malware payload (Mirai)", "value": "acf005ab00a7684d9ef724642e257605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240756, "uuid": "7ec2e8a1-1d0f-421f-9bb1-3a094bb78835", "comment": "Malware payload (Mirai)", "value": "4137846e5cad20e7a86e4849ff2961f275b1afdb5ec648564ed71bd368b339b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240756, "uuid": "15167d2d-4189-450d-bb9b-fc8da8dfdecc", "comment": "Malware payload (Mirai)", "value": "589735624a8cccd48d095c0844846b6103e9fb53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240756, "uuid": "85ffc1c0-95a6-4dbb-8009-5819b83fd931", "comment": "Malware payload (Mirai)", "value": "ac9e3c40f91212c15782aa9b289870f8477f1d9e96eace332b643d27638e2076e80cd256003dfef658f6ecfa926b8c89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240756, "uuid": "2a31c362-8cf0-43bc-9eed-98955f8bcc24", "value": "T1D923E791BC819A2BC2E01379F5AEA58E376173E8D2CB7227CD214B507AC651F0C7AF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240756, "uuid": "6438e1bb-9a30-4b8c-994a-49b02b067bde", "value": "768:20NZFun9VJI/wG4I+F8uOstcKZQIAaPEl3jq+0k8LQjYVC8mUDEC0qIGN9T3vUNC:f4n9Q+F8stc6eaPElxLsBB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240756, "uuid": "fd3277b1-5743-43b2-a304-daa7b8d40bc5", "value": 47308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240756, "uuid": "20fb3e49-eb6f-4eff-bd31-427c8d70f090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240756, "uuid": "239541d7-af09-45a0-b43e-094e18444135", "value": "brichs.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f689ca-c236-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763220120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220120, "uuid": "2e9e0ef7-0786-42da-a627-d136c06c4135", "comment": "Malware payload (ACRStealer)", "value": "7eb14e9801c7ffd81c67e805d5ecc272", "object_relation": "md5", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-6690", "colour": "#3A8A83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220120, "uuid": "25a8f28d-9cde-41c1-9266-f1a55f4069ec", "comment": "Malware payload (ACRStealer)", "value": "41d81f95efc88e77e6fe7e74855bf448c5412da14e80babf7b697380a8044cd9", "object_relation": "sha256", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-6690", "colour": "#3A8A83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220120, "uuid": "b774a850-dc0f-4e30-b4d5-af0ce2534445", "comment": "Malware payload (ACRStealer)", "value": "d80351a03b38a781af582ba107aadd40c771ee4c", "object_relation": "sha1", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-6690", "colour": "#3A8A83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220120, "uuid": "75fad3bd-d0de-4e04-8f7c-83304efd7ac3", "comment": "Malware payload (ACRStealer)", "value": "ab5a91d3361df1a75e5c277018af8d78f2b43f60c0552785db6b2f4d4632a5c10e660a571643ace75c38a7236579475b", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-6690", "colour": "#3A8A83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220120, "uuid": "20689505-069b-40e6-90a0-1dc029dbd037", "value": "T119E633BDA6E4D92767AC3F087F7C44DD005DB625E20014D8475AE7E192E11F8E82F2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220120, "uuid": "49e24c5e-02ea-4600-8577-da32dc3aa35a", "value": "393216:UB9yEysAAjcsf3DkBoY5YRy/zwAfK6goK/JX8hbKy:UB48AAjcsf3D2LYRy/UAfK6gJJHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220120, "uuid": "dc4af66b-8f99-4d3f-bacb-1ecb23866852", "value": 15025056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220120, "uuid": "3017cde7-09ed-49ef-ae56-e208691a5745", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220120, "uuid": "7ba96934-d078-4cf6-bcbf-5f04f04385fa", "value": "\u00ab\ud835\ude88\ud835\ude9e\ud835\ude9b\ud835\ude9c\ud835\ude75\ud835\ude92\ud835\ude95\ud835\ude8e\ud835\ude81\ud835\ude8e\ud835\ude8a\ud835\ude8d\ud835\udea2_\ud835\ude730\ud835\ude86\ud835\ude7d\ud835\ude95\u00d6\ud835\ude8a\ud835\ude8d\u00ab\u00ab6690\u00bb\u00bb__\u00bb.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fd21a0-c263-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763239508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239508, "uuid": "ca42a7ac-32c0-4081-b6a9-b2c398c9e589", "comment": "Malware payload (ValleyRAT)", "value": "415bcb63c19501e06a9a2bffc2240e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239508, "uuid": "ddff3eab-ae30-42bb-8100-81a1f285ede9", "comment": "Malware payload (ValleyRAT)", "value": "44bd7111976a417415c889c9e446147c542d20669286f668681cdd6cb199716c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239508, "uuid": "c76d35f3-833f-4c31-b3c7-2535e4427012", "comment": "Malware payload (ValleyRAT)", "value": "b8618d15b5a40c55311a7ca9149c2348f4741ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239508, "uuid": "874bc936-d280-43ae-a43e-b7615b9e4fae", "comment": "Malware payload (ValleyRAT)", "value": "7af393638de28a877621ef433dfa28aa2211f414316c0e23fd616e61e51a0bc35d621a4b7c04762c88b834c89a175ff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239508, "uuid": "7743ed55-1ea2-4b30-b037-247692ae636b", "value": "T1591512D9EE741376E17718B0642B68CDE5B009E22F38C8B743E607467B712F66136A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239508, "uuid": "4527fbe7-7563-4c90-8ed0-705e7393bfda", "value": "7d36603372af480aec5589b38c9308fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239508, "uuid": "05c8f474-fc55-445c-aa3f-e8d243f12593", "value": "24576:pw/oYEnpaG5K9R7afrTqCDMEHCVffcdX94+wrjIW6B9IRMeOx:pawVo9R+frTqCDMACKXueLB9Rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239508, "uuid": "d3ddc0cc-4cf5-48b3-a38a-e9928308acd5", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239508, "uuid": "a1065703-8659-4f80-a65d-dd5d63f35de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239508, "uuid": "751437f2-6757-407f-adc4-e2bcf91bdd23", "value": "415BCB63C19501E06A9A2BFFC2240E4C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d309e7de-c200-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763196924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763196924, "uuid": "e9d60627-17be-4944-96e0-589aa4111d6a", "comment": "Malware payload (Vidar)", "value": "cc32c063d1cd77fa1bbefd415c132831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763196924, "uuid": "cd0a420d-922d-486c-93b8-7a2e675dad02", "comment": "Malware payload (Vidar)", "value": "45c73b498cdef427396f6bf9d9866b176d54928a96a3514e4cd182f757a1190d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763196924, "uuid": "c87380cc-691f-4850-8fc3-17fb1c04ab73", "comment": "Malware payload (Vidar)", "value": "13a03dee9654a15f9642eae5365c15ba3880611a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763196924, "uuid": "926e25fa-4cd1-44e9-b811-fa5f8128431f", "comment": "Malware payload (Vidar)", "value": "845fb6b3227f422afff58f0ad43820fc7b64c2c4dd5f80f952f76e1b8e1c908d384564cbce9d3f56bb2c23d111e7f180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763196924, "uuid": "0df9b308-8b83-4cca-906b-de2a71cfc44b", "value": "T1571719B49350A8A4C197C0708FC78FF161A0A43752392A0E57C5EA176EBEF749B5D3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763196924, "uuid": "dd3c6154-1c50-4501-a068-ba99002735da", "value": "607da17e8bde18eba5237bbcb4d8af89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763196924, "uuid": "107c80a2-0152-45b4-b3a6-a10b90f623c9", "value": "196608:5Dp6ELxISDvoe8HDM2DIabYbDqiwwQA+Dq:2EuShsPYizwQA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763196924, "uuid": "f9a02fd3-98d8-496f-ac86-cd2590df69ea", "value": 20301312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763196924, "uuid": "4dddf020-684d-492a-92d7-f5a42dc39062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763196924, "uuid": "2cb35403-6141-4876-b33e-7fa15d91f742", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6c61f2-c26a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763242357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242357, "uuid": "d93e87b8-c778-4567-8cff-4ab60ff102c1", "comment": "Malware payload", "value": "897fe3bc00508c34a463e0758845b5c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.MSIL", "colour": "#EA815D", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSIL.Miner", "colour": "#D65309", "exportable": true, "hide_tag": false }, { "name": "trojan.tedy/msil", "colour": "#F4A58C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242357, "uuid": "09e4d26c-c72b-47b8-8c81-249af68237eb", "comment": "Malware payload", "value": "4600482d66bf48259f926ac25d87fd1db0b44ab63817eae8da44a2cdddd1f660", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.MSIL", "colour": "#EA815D", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSIL.Miner", "colour": "#D65309", "exportable": true, "hide_tag": false }, { "name": "trojan.tedy/msil", "colour": "#F4A58C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242357, "uuid": "2353b231-fc40-4252-88dd-073dc65b9272", "comment": "Malware payload", "value": "96873f7a07db723f6de77fe0d6e6b56d859be841", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.MSIL", "colour": "#EA815D", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSIL.Miner", "colour": "#D65309", "exportable": true, "hide_tag": false }, { "name": "trojan.tedy/msil", "colour": "#F4A58C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242357, "uuid": "4435ade4-248b-47f0-b5c9-7542a3a4f3d2", "comment": "Malware payload", "value": "10216a52c66820259474485559cff02bca8ba984f1479a41ddb18e762a47fca34dc54f3b7ab4cfcb49ae59be6835de84", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.MSIL", "colour": "#EA815D", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSIL.Miner", "colour": "#D65309", "exportable": true, "hide_tag": false }, { "name": "trojan.tedy/msil", "colour": "#F4A58C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242357, "uuid": "2e3051e9-0ada-4acc-80ed-0071e1a1830c", "value": "T1B926339974D89F0AC1986CB8C0E31B7587C1BB9762B3CB02BD4A52585D02FDDBC166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242357, "uuid": "b32081ee-ef98-434f-a71b-c09a9532fabf", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242357, "uuid": "f8a52d53-d66e-4bfb-813e-89e3e0a4c9cd", "value": "98304:O/Un1E3MX7WU3HDbSKkOe+YPAcosghXY9irEt5vz4jnDX2cr:O/Un1EcyU3jbSKBi/5ghXY9iYt5vz4jC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763242357, "uuid": "d6925b53-1f9b-44d1-a65f-be1cd7fc432c", "value": 4618752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763242357, "uuid": "82979d21-7473-4505-9bd4-8af606a71156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242357, "uuid": "aa12c82a-049b-483d-a371-e3068f076beb", "value": "b.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffcea78-c238-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1763220702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220702, "uuid": "3c8c9cc0-af41-4668-a5fc-c990f98a61a7", "comment": "Malware payload (Efimer)", "value": "09a76d74bb969167abc8f10224179ce0", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220702, "uuid": "a12aa657-8318-4a7c-9b85-7d21d376e6c2", "comment": "Malware payload (Efimer)", "value": "461e0bc95c73e57c68433a1c8ffa9cde3071e0bc361cf54a8f3eae57bf7eb2a5", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220702, "uuid": "a63c339d-daf9-46af-8bdb-18f58ba7db8d", "comment": "Malware payload (Efimer)", "value": "5f34907661cbeffaf421c9c32700a3b3cb020486", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220702, "uuid": "b5d82436-38e0-4135-8864-4b78042976d8", "comment": "Malware payload (Efimer)", "value": "e5f6415c7a86ec067c85320f3641dc31db60322738ac5fc0807e63b0f6c8b535b2070f72c2ee7ac4871c66083c817d8c", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220702, "uuid": "69936c24-3587-45b2-bdc2-5ee766916df2", "value": "T115D63310B6D025E4ECB30134AAB3C9799A297D664B70C9EF07E43E537E7B3D24829617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220702, "uuid": "8b55faf5-f383-4212-8575-d1a4dbc8bf97", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220702, "uuid": "95a72de4-eb32-422c-b7fb-61e2858e6220", "value": "393216:NRQ6fD243zRcKL7Xyl74fXMCHWUjG8cuI3/PjuUw0:N66fqkzRcW7XO4fXMb8yH/rA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220702, "uuid": "ceed60c5-3a19-46b0-9b51-006e931a99d6", "value": 12957039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220702, "uuid": "11762744-ba3f-4121-80f4-2a1a82b2f173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220702, "uuid": "d6fd29a3-4309-474e-945a-15cfffc2ac46", "value": "\ud835\udc1a\ud835\udc1ft\ud835\udc52\ud835\udc2b_\ud835\udc1ef\ud835\udc53\ud835\udc1ec\ud835\udc2ds_\ud835\udc63\ud835\udfda\ud835\udfdf94_\ud835\udc20\ud835\udc2e\ud835\udc51_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9dcb88-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230820, "uuid": "1675a9da-fb4e-4d66-8b5c-098a7ab1f2d4", "comment": "Malware payload", "value": "62c22bfe4e013e91805d8e362228511d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230820, "uuid": "87a86558-22f9-4a15-8b8c-deceaf7c5bcf", "comment": "Malware payload", "value": "46b72949a664b70fa65a40b4cc30aea89b5b3648e74d7fda4305a52ac6bd21a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230820, "uuid": "e4add949-6f2e-4874-b645-ecb43b5f2bfa", "comment": "Malware payload", "value": "4551db71b4fe198795d2ecdd9dfafb9084198777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230820, "uuid": "9289be09-0bab-4e90-8c25-040415d66464", "comment": "Malware payload", "value": "1c9fc746aee6e3a96a91db401a45917034d16187cdb0e332207c146ad56fe4c6d51c94820741280464f32ef6048fad58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230820, "uuid": "9418d1c9-c219-4c35-b02d-391a680d8ee9", "value": "T12FB5AF65ABB420F8D56BC13CC9734517EAF2F4551360A7CF07A086A62F237E19E3A391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230820, "uuid": "1cc1f263-f8c2-49c2-b602-afb4e047e592", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230820, "uuid": "868845fc-6497-49bb-90d7-6cfeae7481f1", "value": "49152:93f13mS5Az6MuwHCjiDP4qI934KvDVVH20vDNj:9vMlz6MuwHCjiDZwVH20vDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230820, "uuid": "18c691e4-a02c-4a6c-b0af-ab7b325e4c87", "value": 2309120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230820, "uuid": "77fa4f22-8005-429b-8f51-a83dd5c32189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230820, "uuid": "68b6c17b-9709-4f23-9cb8-5ac9462688ce", "value": "xfseqqau.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec205069-c201-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763197396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197396, "uuid": "073ac55e-e49e-4119-94bd-6d0c9e807cb5", "comment": "Malware payload (Mirai)", "value": "3b700855e77ca8cf425ce8683e692deb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197396, "uuid": "c4f0276d-f9af-456d-9b30-18162c480544", "comment": "Malware payload (Mirai)", "value": "47438305b91bceec94d75dd203d18fab47d287dacc9282632af9dd4694849c93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197396, "uuid": "51182a33-9f44-4b43-a7d2-3522911c4447", "comment": "Malware payload (Mirai)", "value": "9eb1ed11b28f0c04a6a6c609ad69c1206a57701b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197396, "uuid": "64d1c018-3ac3-4e64-a9e8-3bbb395b908b", "comment": "Malware payload (Mirai)", "value": "a9442c0b2d1493cb139b2402e667d58dfd48a4e183b3f5ceb46ca9a84560e197a4a57dd9c1a602aa69cace46fdf743f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197396, "uuid": "f57db5d4-8bf3-475e-97a4-d30cbf8c1be4", "value": "T185A3961E7E119FACF769823147F74E25A75823D627E1D281E2ACC5102FA034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197396, "uuid": "1a3198cb-2cd2-4e73-ad3c-a00ec70d1b41", "value": "1536:grkwNwUsyAEjfPYfK7hmwdEfrZQP7pXWh0BaXDsfYWe4:gtNwfyAblxr9zsQf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763197396, "uuid": "91a3da33-dd54-40a5-90d8-986654ee4402", "value": 101068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763197396, "uuid": "9421729b-eb33-4725-959b-cbbdd83a4970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197396, "uuid": "b7e1e787-f939-4945-b3be-62f62547e9cd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e8359a-c1c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763170939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763170939, "uuid": "ba24fcc0-673d-47f8-a6a9-4a0a64e90cae", "comment": "Malware payload (Mirai)", "value": "1596f880a000c98d8417693bc7b3f2fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763170939, "uuid": "b0120d67-e810-48af-90e6-ac63866d3c63", "comment": "Malware payload (Mirai)", "value": "4777ac5dce05765c9f3e1537aab16d70868619209597356beddbaf09a310971f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763170939, "uuid": "a4e221bb-87f4-42c9-bf4e-c8bea8216530", "comment": "Malware payload (Mirai)", "value": "e964ee422208c97dac74de626e2b87f8c3ea2ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763170939, "uuid": "174e7eaa-7154-4bb2-b140-77135ec075ce", "comment": "Malware payload (Mirai)", "value": "fcd206e5d77ef74e768973e29981558b5db87725ecfa6b45f50d1eefcecc638f84ac3d58115ceabd596ee2e6a7850aa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763170939, "uuid": "d64e61a1-3f05-49d1-9978-9b9ae948966b", "value": "T1EAB36CC9F643D0F9EC5705342136FB37AE72E4BE1228DA93D3A49A727C22641C456ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763170939, "uuid": "30070977-e641-4c5d-8184-fe4ea1ff0fa6", "value": "3072:btRmink4F+GkruClejzdo3gBs4dZpCiBT:btRmMk4kGCrd4dZpCiBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763170939, "uuid": "02ad2f3b-a0d9-4645-9d04-f46ece7dfdbd", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763170939, "uuid": "b2328a8d-b00f-4024-a0cb-fd13b0d56f95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763170939, "uuid": "f0559dc8-fecb-4cca-b33e-8546420fece4", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d740197-c249-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763228026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228026, "uuid": "e33ebfeb-a89f-48c6-b19c-3221e58c487b", "comment": "Malware payload (Mirai)", "value": "de35386d0701e3f63515f67e4720447c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228026, "uuid": "00ffa61b-9177-4c87-bcb8-d8eba4098372", "comment": "Malware payload (Mirai)", "value": "48494bc2a98774569b60d6e657af2c1c781be83867fe60a12a8fa2f4279964b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228026, "uuid": "9fe6d5f2-4cd1-42d2-ae37-e69ed1829c67", "comment": "Malware payload (Mirai)", "value": "8b1c313359ec1ce519be25a0dc2249203e6d60a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228026, "uuid": "f8007401-2c8d-4a4a-a664-d79fd62021f2", "comment": "Malware payload (Mirai)", "value": "d24130288bcaceb4b251126dc3a94d8e77e3c5b7d3e0cdc616df10c08b10b6da7c906fcf4dacc83cb4ce8df229d359ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228026, "uuid": "16467af7-acd0-451a-8fac-1b3bf8d9dec7", "value": "T16DD2F2101746E8D1C6701D35D2B68ED6AF57DBE880DEF23A366095746DC204DC6B73D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228026, "uuid": "23fbaafe-825d-417b-8d71-f2182a5bfb1c", "value": "768:7nrB/Gvs2UTYZ1iG2ruuhjpAQKRo+Na/u9ls3UozHX:7rJYDwru2jbKRo6oz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763228026, "uuid": "62b0d455-8086-4fdb-8680-33fbf1ee8ced", "value": 30952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763228026, "uuid": "db4ecc04-af0b-4f5a-9711-e571006f2556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228026, "uuid": "a8b98692-9c4a-42f2-862e-7ffc3c7dc3db", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ba7e86-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239885, "uuid": "64d08ae2-b773-43ae-8995-3b880a609c20", "comment": "Malware payload (Mirai)", "value": "3543b363b6d94ac5fde7874a1aadb36d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239885, "uuid": "83335bd4-878f-40b7-9889-98af7931ae54", "comment": "Malware payload (Mirai)", "value": "48e7d297caa37fe1c55f1be4fd9c1aee10748967879a2370826fd389ce5f2770", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239885, "uuid": "658b1fab-c7a0-4dcb-8729-0e10badd7a2c", "comment": "Malware payload (Mirai)", "value": "9aec11e889d9a61ec9fb3a18f89435a3e0bf4b12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239885, "uuid": "e7b93486-176c-4c9d-b8bc-60e93b3946f3", "comment": "Malware payload (Mirai)", "value": "49e9619bc1aeee60581aa88c6e479e3d38c8abdcf6d3656f08c99d8c088f1fe2e022da494ecb00895f949b2b66d0c840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239885, "uuid": "826c384b-5aef-4490-aeba-1cf7d707ce11", "value": "T11B041916BF110EFBD85BCD3B45B92B0124DC585A22E97B3ABA34C418F54B25F2AD3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239885, "uuid": "cd23f586-d5b7-4231-93fb-a7b1ee720f5e", "value": "3072:fiN3JMJdXC9yVGNOjyqHtzfTZjc2Slfx2Bnczpj:fiBJMJdXLxlfTZI2SRx7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239885, "uuid": "1a6a2004-985b-4c30-9b9a-970bd03d27a6", "value": 177004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239885, "uuid": "275ba7b8-2271-4164-8a63-1a0947307980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239885, "uuid": "09975b41-7fa2-469c-8d2d-319eddf9160f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd02baa3-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239890, "uuid": "f0014031-c919-4b62-aa60-b09eb57136f4", "comment": "Malware payload (Mirai)", "value": "99041fc8585122ec0ea120e2c63b2853", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239890, "uuid": "e692e08f-6ebe-429a-9b24-56592acf4f4b", "comment": "Malware payload (Mirai)", "value": "49b66bdd7e4a32ba2423391c1e86b3813309122eff5bd7c245a5359675b1d581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239890, "uuid": "25dbacb1-b9b6-49a9-bca2-cf6fa6158725", "comment": "Malware payload (Mirai)", "value": "451534356c5d09933030667a0055fd11c3f26daf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239890, "uuid": "10742f8b-6585-4cb9-b6fe-120ab0c062df", "comment": "Malware payload (Mirai)", "value": "6f13e3a1b7aa2e26a8cd2d295d6f2804f21f73916a02e9c5b625c86235950f6c86f1539e1e7dc9194f205f7f4b35ca9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239890, "uuid": "c47ae8bf-c61e-4921-be24-46c323b2665c", "value": "T131D34A2275391E2BC4D0A87E22F74761F1F167DA25A8C90E7EB30D4FEF252206517AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239890, "uuid": "584f4f53-c31f-41a5-b0e2-f0d4e058202b", "value": "3072:sBldhO3+cB9BTqLajgvZqf+30xncIbl8Lgnla:qldh2FB9oLTqWMbmLmla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239890, "uuid": "cd315873-97f8-4c88-a0d2-bc5b5630a4dd", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239890, "uuid": "c9894e3e-8acf-4f42-8dbc-3c62048b4150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239890, "uuid": "d259e99b-17a2-49da-8b6a-c070fc3497b7", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0a8fed-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239894, "uuid": "9ba7a8cf-cb10-4ecd-8843-9d0239ed45f8", "comment": "Malware payload (Mirai)", "value": "0f9d43e60a9ecdfe953b7cf9f4efa7d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239894, "uuid": "57005681-7571-41a4-8de4-1528e9b3d384", "comment": "Malware payload (Mirai)", "value": "4a89734bc25dd99d3a9e2eeeacdbefab1658fa7a46b63ba1d4183a2e0b64df90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239894, "uuid": "b1186b55-5ce0-4fa9-9bc7-63481e79b989", "comment": "Malware payload (Mirai)", "value": "0a3cd90664f86c95ab5e5fa767db5d552ce40b04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239894, "uuid": "977dd62f-9a2b-4c8b-bc62-18cbd3fc17f9", "comment": "Malware payload (Mirai)", "value": "f66ecae4cf2dae370f1c25d23be2c4cf00159fb1386b12dcb5692f8288e0d665e5987852a2cdd5322dc7116ea5c73702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239894, "uuid": "b6106715-97c6-43ae-be75-f36495c83e45", "value": "T1CFD33951B8825A27C5D523BBFA6E028D332963E8D2DF71179C215F217BC691F0DB7A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239894, "uuid": "57e9fa4e-652c-486a-962f-2a0bf7b8fd01", "value": "1536:vrC6uZMkwCc5xFKqJ2AjHSUIOQYacwV84V77UtLpR9oGI2Kxz7JRjiSiSd9CsXM7:vrCukwCoqUI8677UtNol2K1J5TnLtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239894, "uuid": "d5430395-8727-44e4-87af-63d6281f0edb", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239894, "uuid": "e4326dcb-6f20-419b-a9e7-d6b540c6b9ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239894, "uuid": "34fb7695-04ec-4cf6-81f0-a904012c824d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5371398b-c256-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763233647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233647, "uuid": "421b9f37-b727-44a1-afd0-04656c2572b3", "comment": "Malware payload (Mirai)", "value": "b07bd5a829b2904f79845fbf0ae5e10b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233647, "uuid": "e1a2467e-b1ce-4250-a379-bbf06265cc9a", "comment": "Malware payload (Mirai)", "value": "4c363fe34621a86f2e995f05684d45e239f06ea0a2c5e1e6f923e36bc2db933e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233647, "uuid": "88d120b5-a07e-4e74-acbc-5630b8de5e6a", "comment": "Malware payload (Mirai)", "value": "d2a261edade1d872b3c971ccebc43b69cfd33298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233647, "uuid": "873e329e-c985-41a3-9b08-2f4735ea037f", "comment": "Malware payload (Mirai)", "value": "3d5773b05f53d7562b7939f0ec51599a99c6ed4f9839d9df5c62c83e97b748337c7025174929262b9339709df20b19ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233647, "uuid": "1f48e415-e11a-4f05-bbc2-1e0cfcf151f0", "value": "T1E6D3179DF68BC6F6D81748308036B3FFC731F4255071C6AAEF99AF25CA239819216359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233647, "uuid": "a875c981-46d8-4bcd-9897-549f04154c54", "value": "1536:IRBFLdGYcvrMJ7Y0xUj7WfiMMJfhQGwJfeuOFWhEMUIFe5sanmdz7dPFrtO4MB:ABnzQrkE0ej65+fhUW6qh4eia+9tPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763233647, "uuid": "55da3912-37fa-400b-8a26-eb3039e002b5", "value": 137580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763233647, "uuid": "d1573e0b-a188-425e-9b21-73b8330c9718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233647, "uuid": "64bb0c78-39ad-4b3e-98ef-1132fa699b48", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb15eb4-c249-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763227943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763227943, "uuid": "d1ec21a9-c128-4acd-aa50-ddd78c8b6ccb", "comment": "Malware payload (Mirai)", "value": "e3161c2c57ecf2d30efd4fd178974240", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763227943, "uuid": "7382336e-c900-4a00-adc8-0aae7ea716c2", "comment": "Malware payload (Mirai)", "value": "4c5d32deaf2f64fc973471b318a9cfad2cc078b2bafac9ce0df59182fe17896f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763227943, "uuid": "b18745bd-1551-4ade-80ac-ff717cd0d946", "comment": "Malware payload (Mirai)", "value": "dc586eba2207632cdd345549dd8cb2da0871ad4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763227943, "uuid": "d75a0743-3a42-4bd3-9496-3323911db54f", "comment": "Malware payload (Mirai)", "value": "31cb5f506c8c8b489ccea6560d7f9589a8f0f231241f4d512a9eb7e35ad26a4e901bfe91b7a89bfd6c2a5f7b2cd6de72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763227943, "uuid": "15d75830-44fc-49ce-82e9-28a91d4cd358", "value": "T1D46309C2FCD2951AC1D067BFA66FB59D3361E3D0D2CA3617D8970B11338629A4F26B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763227943, "uuid": "13b9e7c1-0446-42ed-b257-420dffe982e5", "value": "1536:qIbnqpVMq5pY0lX3+FZkgdNLWVZGLN0IVGeY7:ZbnmMqn+d3Kih0STc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763227943, "uuid": "012c140d-7cbb-43c9-9e88-ca22525e04c7", "value": 69392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763227943, "uuid": "22dd54ae-287e-4275-8796-88799cbafe79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763227943, "uuid": "dd293df7-b8dc-43a6-8a84-c4659fb27edd", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e61feb-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239883, "uuid": "31bba774-92f3-4931-af89-627e2bd00c11", "comment": "Malware payload (Mirai)", "value": "09baa8fff7d86425316c27f15561617c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239883, "uuid": "d6ae455d-d520-4971-bf9c-a784f9db601b", "comment": "Malware payload (Mirai)", "value": "4e9f1c7113914a5bd723dcadb53360f3bbc406748ee31774ad2394402ae4f721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239883, "uuid": "5793b9ca-a4be-4911-a472-7f4ac81d67b4", "comment": "Malware payload (Mirai)", "value": "b28a0695c13f1e0a13ad15ddb14e4709b3a91876", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239883, "uuid": "276cbd0b-c833-4213-bdc4-489d94e59099", "comment": "Malware payload (Mirai)", "value": "3c2dd57f20a3107b02b70bdc81020fd044d17393acce84d757937c3b16c98a642e2de6b87e7e1f1f0a7e45943c6c7b04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239883, "uuid": "bcc40c48-e424-4478-851e-5b3da5fd284b", "value": "T154C3AE36D42A79C4C0914534F4F09E751BB1A1C442576EBB2AE9D5B900C3DA8FA0EFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239883, "uuid": "4c34decf-4dee-42d9-bd7a-4609145ca582", "value": "3072:wwYYZdqZqMYn8wUjqbBD33rNGvN88fMEU:wEZaTwP33roFMEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239883, "uuid": "e2d54bbb-a406-49d0-939c-7896648e0448", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239883, "uuid": "ed6d8ff0-eb45-4dff-b6a2-afe39bd1fd07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239883, "uuid": "f63e6373-121c-43c0-b331-3c22c054d48f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9506abd5-c236-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1763220013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220013, "uuid": "86c20924-265b-4d60-ab99-f0b5e983de18", "comment": "Malware payload (Arechclient2)", "value": "e25c8becb26a8ca602d21d2dcc4d4a05", "object_relation": "md5", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220013, "uuid": "96ef2adf-e4a0-410b-9206-b744a301b0f6", "comment": "Malware payload (Arechclient2)", "value": "4ee453e4721d51b26986f44df8c33c44f8f7b89915968e405056b010e50f48d4", "object_relation": "sha256", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220013, "uuid": "5ada8197-14be-4bd9-b60d-2482e46a54e9", "comment": "Malware payload (Arechclient2)", "value": "df07e846756f6cf443a679eb266f977fa732115a", "object_relation": "sha1", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220013, "uuid": "699cd58d-56e7-49e1-9718-ed4d17641093", "comment": "Malware payload (Arechclient2)", "value": "70f005bc8688501cf711dbda5aee4786fb466cb231186ca3dd415189c55d7d7a00b86c4f1a58085aa30dc7c0d6a29292", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220013, "uuid": "cfca6893-1929-48dc-b2eb-aeb3a4ae132c", "value": "T127145022FD854DA392D3DE73E1F3D20CBEB8849C440B9DC99978C2C298A0D664799F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220013, "uuid": "cfa00aea-264c-4548-83ea-db9ef636c915", "value": "768:H0sKdinfZW470hooq4YVn/S2mR9NHprZ2k9hDA/OY3/vEdkkHPw6CGKsHKoQiHkI:H0FAx/Mn3OkE1dZwNymEZib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220013, "uuid": "71ddca15-85be-4d11-94b9-8c3a484d44ac", "value": 195515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220013, "uuid": "1a718f95-47f2-414f-895d-b7a654fb3330", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220013, "uuid": "891893d5-be07-496a-a78f-829491d1f488", "value": "gistfile1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3277ec25-c24a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763228437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228437, "uuid": "15e85a6b-f0d7-4d2d-92b0-20b62021f937", "comment": "Malware payload (Mirai)", "value": "7ba070b8f1e15f5dc76ec2c7fd926c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228437, "uuid": "deb4bf3b-99a7-45a2-a162-86cc5d012d78", "comment": "Malware payload (Mirai)", "value": "4f75c9b7c498457a8a19757cb37354632a24596cf4501b0768b789b5e73ff033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228437, "uuid": "bba14b49-390a-4f9f-9dab-f8fd1ba2f11d", "comment": "Malware payload (Mirai)", "value": "c0c996c96017220a7c42793b3ed8cbc119c3fcce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228437, "uuid": "2826b2f0-afe1-45d6-98b1-d902d8d99c94", "comment": "Malware payload (Mirai)", "value": "53d1c3c7acc85e3e592b8915f41500056f31c1f6566f582d5f8fd4183bb16ec3f88d5afc111bc580a6d61a55a3a9357b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228437, "uuid": "03210cef-d684-4d09-afde-824b3f252a46", "value": "T1D6144B46EA414E13C4D7137AB6AF424A333297A4D3DB73068D286FB43BC279E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228437, "uuid": "1c03488a-9552-443e-a429-e2d032d6c3dc", "value": "6144:TJTPwUaRtjVevp4NZaibRblc6ssNCttch23b5M/9/2Sg:TJjwUaRpMuNZaibRblc6s2YSwu/9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763228437, "uuid": "ecfa0ba7-9f8c-4211-9b70-b78e4d84dd1e", "value": 201647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763228437, "uuid": "f7108e22-8a17-42f5-bc8a-c21f224f5a4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228437, "uuid": "bafb31a4-d090-4ef1-9162-13527dae1460", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad082b52-c236-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1763220053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220053, "uuid": "6d7cbf4a-7fd7-45c2-af62-043d6351543d", "comment": "Malware payload (Arechclient2)", "value": "a8b2ffd71aece8d6a481238f7b0b8e34", "object_relation": "md5", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220053, "uuid": "b778a73e-563a-44bf-ac99-450c35201536", "comment": "Malware payload (Arechclient2)", "value": "53a212d8ae3dd14bd22f8bcb8ec92d449e722541f07a0f5ef809af44fa69569b", "object_relation": "sha256", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220053, "uuid": "7b2a80a7-f874-47d2-906f-8e0eb8184a70", "comment": "Malware payload (Arechclient2)", "value": "a2c26ca9cc28c8d7593e0bac4dfbc89fb2ccb3ff", "object_relation": "sha1", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220053, "uuid": "ae075bad-d3f5-4bd4-ad0b-54c21ddd51bd", "comment": "Malware payload (Arechclient2)", "value": "c85be5b005b02db30cb13c3f80971a28eb2e521117c903bc5940ce05da6bbed983ae9b6b73344b8660b1c3b8e5cb5957", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220053, "uuid": "69757a21-4153-42ac-bcd7-503dfd344f86", "value": "T1745633E7C12D7047AEBEB770D1C5648E890D217C65DBCBE4EE748F1C1797888AA69203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220053, "uuid": "57ba97b2-dabd-4a7a-b092-293bf3a53168", "value": "98304:Cu5KuroD5okpRiLhJVTkkoj9lA8zSIicMcgt82jeiGU0DW1hP4WgtNw1Z+bqs:7IurGokiVTkJj9lvz7icMcabWDW193U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220053, "uuid": "1eda5572-c887-4119-98de-0b171238818a", "value": 6224453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220053, "uuid": "6f821b8d-ff45-4eb4-b6c7-0051794f2aa7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220053, "uuid": "20e5e971-8bdd-44c9-a5a6-313cd2820dde", "value": "gseuomzjme.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579114a2-c20b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763201441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763201441, "uuid": "0176094b-4e8a-49b3-8bfd-d7a4627ade4a", "comment": "Malware payload", "value": "03a7bad7292c8fbdc4ac25ed83cf38bb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763201441, "uuid": "6cb64711-f273-4376-8089-07ea67364202", "comment": "Malware payload", "value": "55b3ec4ebfe1a2765ecbb18c84b9e70779774d56ab42778b09e83f02e3df7934", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763201441, "uuid": "11f629b4-19b2-4a8b-bdb4-96efad05c1ef", "comment": "Malware payload", "value": "78938ff1d27fa901158428320d85dc439622607d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763201441, "uuid": "61ee6c7b-c985-4038-a8dd-53b0fffa34b7", "comment": "Malware payload", "value": "eb21fd4da224285610026369754ff7a3f4772fd7cd84060307d0580977bd9505339f721c41863117debb54a44e99b56e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763201441, "uuid": "2cdfd968-b395-426c-af6b-0288cf49cb9a", "value": "T15154010890F19E2ECEB40E983CBD2D075A6191C5627616CFDA6F9C42BFDB81905F70AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763201441, "uuid": "bd6cb200-ba48-42aa-bda7-2af266b6951a", "value": "6144:l3I3Q7tHr/fuLTAwo9ZLNm1PQXcwyshgZQiiKPxUbl81OzpAk:9aQZHzW/yZM1QXbys2GbdCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763201441, "uuid": "9659f897-812b-4e87-872d-91810440ef34", "value": 305277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763201441, "uuid": "0eac43fb-08ba-4a6f-9f8d-710d51994093", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763201441, "uuid": "3dd64bde-3f7c-463b-a051-fc8f2962070c", "value": "wing.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76e8049-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200716, "uuid": "a1d7daf2-9aff-455a-8a45-7d7b828edc10", "comment": "Malware payload (Mirai)", "value": "62f4fa299e0190f5c84f5dc881365c34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200716, "uuid": "da7f7c77-ee16-48c9-9fd6-00c699f66fba", "comment": "Malware payload (Mirai)", "value": "575cba18e62f226a97d40e53fe2db68f8b5a5cce7dd9e59350c4690e447dd99a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200716, "uuid": "7277c7fe-0fa7-48d1-9fa9-62afff3b2634", "comment": "Malware payload (Mirai)", "value": "78f8b96f69945a4b046cf2c50298e500ea53a421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200716, "uuid": "6b6e875a-f1e4-4dc6-af5d-21849bd5eb3a", "comment": "Malware payload (Mirai)", "value": "31ad62404e23a3c4b1b95a406fda6d78977d85eba60fda56f228b50beebaa9043f3b3550c8897cbd2c718a1dd7d548bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200716, "uuid": "ad070f50-7a49-4e52-a657-8beab6a1d509", "value": "T1E9D32B46AB414A13C4D52779BAEF42493323A754D3DF730689286FB43F86BAF0E67502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200716, "uuid": "cd808f6e-8182-46ae-8b72-37fe48d74833", "value": "3072:lIz+md1S57vwqA2YpOAA57vcY8uaLhyAUWPxPM/9Q:lcR2YVA57vcYDaLVUWP1M/9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200716, "uuid": "b1e923a0-fcd4-4272-adca-41eb238ed4bc", "value": 136705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200716, "uuid": "a39eb8d6-d65b-49b1-8050-2b81615fe887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200716, "uuid": "647e9f86-fd21-4966-91bc-c79a7fb43cd5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad2f29d-c1bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763167221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167221, "uuid": "c4355967-5083-4a68-9e3a-c9606c63a69c", "comment": "Malware payload (Mirai)", "value": "f22ff1cfe684d2be9a1977755718b56d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167221, "uuid": "e152d726-e636-4ae5-87e6-4a9f7afd69bf", "comment": "Malware payload (Mirai)", "value": "578606bc8fd602ef69ab6bf64beadce9ef92a33a0a311c701e9135db2119cde3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167221, "uuid": "210c16ba-f2ba-4e24-9b6d-b57be528293a", "comment": "Malware payload (Mirai)", "value": "805b420bbbf61f0880c5e9fae1d6b7f73ede20f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167221, "uuid": "8e603565-6a68-4942-a41d-89753d36e93e", "comment": "Malware payload (Mirai)", "value": "e78b19cede3bed2a2c63f12dcddc01a2d161750ed322ac2cf35966552e2fdcce4cb29382af4b85dfc5cff20bed37dfa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167221, "uuid": "80833fb0-0a87-4a48-84ff-ce56e9845f35", "value": "T11503E1AD3CAE1CC9CE4D9D3A707A423216062CC1195F9F2E6664CD9BD360F0E7D7A069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167221, "uuid": "77004779-1543-488d-a3e8-fff1b9e4bf70", "value": "768:Qwh/l0W+fMwzKyqqCoP7C2vxF1J7u4m4T22y3EjQb39WlO2:X/mW+ffzHBPTF1J7u4rljQbyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763167221, "uuid": "418e298e-e0c7-4d03-a25b-e9d5f5526be4", "value": 40204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763167221, "uuid": "6ef3add2-7933-4dce-93cc-0ef2f7f4728c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167221, "uuid": "87875194-1052-4af5-9762-715fcd3a9edd", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d207ac50-c253-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763232571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232571, "uuid": "8fa1546c-68e2-44ea-89c8-2194f2a6fe84", "comment": "Malware payload", "value": "9176f6db2018c8f04cb815e7185c75d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232571, "uuid": "46077dfd-3d59-4f94-b015-622383748910", "comment": "Malware payload", "value": "58190f56d490fbc0277648dda25653eb42a60eb4b661ad5edc4f12b1b25021ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232571, "uuid": "a716fe87-7714-4f79-b38a-514792127bcd", "comment": "Malware payload", "value": "deabf69742144e8cd37ba5a5a4ec9dc24105acb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232571, "uuid": "cdaf1542-70df-4ada-942c-712c2098f7f9", "comment": "Malware payload", "value": "0308c3de9edae5d87407af9f1705353ac82eaf8e770a846835df85d887dc6b832c606bff0aa8c664645a6ba68f5cf42a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232571, "uuid": "80407fa1-ee11-4dd3-b30d-ed282827e2ec", "value": "T121E48D98FE4E3D42D2C7E33DDF8587E1212B75E4D32382B27981125DE4DAEE9CAA1111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232571, "uuid": "690e3eda-7dc5-4b35-a05d-b0be61386749", "value": "12288:zUU7+2Wl7BoBgt38I+/W4TCXjt5WLUFiNuSIs5ofLlN:n7nW/J8G4TCXjncUjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763232571, "uuid": "45c66330-fe5d-4409-8764-e9db6daaa6e0", "value": 706784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763232571, "uuid": "0f2138b9-8c79-4e9c-940a-36b38d7ee84a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232571, "uuid": "2b80b98e-fcef-4bf7-9903-3eca37f5f693", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c263b0-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200715, "uuid": "e05333b2-ef08-4f88-9a05-2cb9e5d5c63c", "comment": "Malware payload (Mirai)", "value": "6cde7aa7581ca160387a62f593ac8714", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200715, "uuid": "f09deddb-23a8-4a39-94e2-4f92b182ad12", "comment": "Malware payload (Mirai)", "value": "5876ba1bbcd1517ec1aa6e24d3ad993279aa00eac9daa4fc21a9d37a0c8d5903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200715, "uuid": "cf84843f-5a8c-4aae-858e-1b7b32fd0c6a", "comment": "Malware payload (Mirai)", "value": "a3267959a01d68651eaf751fc7efdb8a84833455", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200715, "uuid": "1ea80768-c27e-41cb-a348-cb20c6698336", "comment": "Malware payload (Mirai)", "value": "f4cc8fe8de69fa67afab6067908fbf373a63d7e1d8fb672690e2a66337051e609ed65065b38aec4de46436112574b653", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200715, "uuid": "e309669f-7e3f-4fd3-a7d4-28cf1463301a", "value": "T115731903F58985FDC04AC170AB6F943BD971BD5D123C7AAB1B84FF212D6AE311A4DA84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200715, "uuid": "c99f9876-1fa5-4fa3-b003-ceb004e6d7b6", "value": "1536:+PXoJarMVCkN43KbQ1hQwkaXDM1h1pun27Wp/3Yyr:EXoarzmaPQwkim1un2Egq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200715, "uuid": "cf54448a-82c6-406f-9683-d22b01b0f561", "value": 77952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200715, "uuid": "cbc0ea7a-ff9f-4d3d-8ff4-4ed2d7117fab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200715, "uuid": "76ffec02-a85a-423f-9812-290ef333c0f8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56338fbb-c254-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763232792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232792, "uuid": "c1e91d8e-023f-4ff4-8bef-81c903f7dffa", "comment": "Malware payload (Mirai)", "value": "71c8633d2f0618ac2d21d8434fd23c40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232792, "uuid": "e7640de8-dd0e-44e9-90d6-f5799e25857e", "comment": "Malware payload (Mirai)", "value": "5c08ebe6558b86f3ab363b062cefb8e699a27f699d7d1e4cc67d90fb3e5766c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232792, "uuid": "796efd28-666b-4b11-a889-d2400bd84df3", "comment": "Malware payload (Mirai)", "value": "bda75cac8f76e4be4be9d89eb758205147dafde8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232792, "uuid": "8a5df4f3-059c-4b45-8944-87d7f786be1f", "comment": "Malware payload (Mirai)", "value": "17f6d2144bbad42bc11e6d4cd6e29c3be12cb7922837977511feb2f32c194f991e515c6c25adc59fade9a4741b54bbcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232792, "uuid": "071f56f4-bbf3-4a6a-b273-bd259fe4d9f6", "value": "T15533F1ABD135603DCC6CCDB8419E6A62DFD8B0C472578B8817256DCE89CCA57B24C87E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232792, "uuid": "f506dd93-442f-46ae-afe6-7c175dd3a224", "value": "768:zZtFqEBJ8r1XHfJZVXxhz+9TA9Gk4eVRsuP4pOOFzJv2SmzEKHbXlIxhWU/:TwyovJTz2U4k4KWPzJlmzb72j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763232792, "uuid": "2781fc2e-d239-40d3-a9ba-7f45c256b54b", "value": 50372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763232792, "uuid": "03d60fc4-1f9e-4eed-96a8-273e41c5254b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232792, "uuid": "d1a458f6-30a8-4894-9dda-948d3168da57", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1334d5df-c258-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763234398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234398, "uuid": "eb2ae3f7-3df4-425d-9a19-65f41e75dd80", "comment": "Malware payload", "value": "0c41bcd4b0bed82106d73f83f88c4445", "object_relation": "md5", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234398, "uuid": "8188d960-8e63-43ee-9f9c-8cfc89036539", "comment": "Malware payload", "value": "5c0fc49ed99e75886fe61c3fc41c587900775230ac518e059dbf779660dfaec6", "object_relation": "sha256", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234398, "uuid": "7222c4c0-c6d4-4acf-825b-38868f777057", "comment": "Malware payload", "value": "7f8cd2a438e40b1ee369bb0db53b4c77ce5c1903", "object_relation": "sha1", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234398, "uuid": "72eab203-8209-4956-9f1f-d92abee6840f", "comment": "Malware payload", "value": "6855acf6f2c7fa456546891e71d4dbbffc95483584e3bdbd6f5a7521dc386bb9437532f650424ab34c34ed4a1cc1f4f4", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234398, "uuid": "6ffde374-43aa-4231-92e3-f3a62cf77369", "value": "T106E423258EB114BEE213C17AE49717727AF13B613372EED9214095FA083B25B218767F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234398, "uuid": "0ef64f11-d54a-4004-b46a-fc28cab0b200", "value": "22611ae1c181bb107345c700d21127a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234398, "uuid": "479a8865-9462-4856-afc7-ad7112e13e82", "value": "12288:IkqjVnl36ud0zR/6CtQ9PUHIG8DPqyC8CD3agb88wWn+ah0xPKd2bKRC:IkqjVnlqud+/2P+A8TDqgb88wWnVWxtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763234398, "uuid": "3cb3d9f8-e84a-4271-a393-96652f059986", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763234398, "uuid": "e260a37a-817f-4c48-90dd-73a121b2db0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234398, "uuid": "14320864-68d1-43fd-af07-2f9fccbf4996", "value": "FileSyncFALWB_x3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42311d3d-c268-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763241349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241349, "uuid": "a8e5c0ce-0294-4059-ba65-0a83e8a5fa31", "comment": "Malware payload", "value": "0122343442e2cf893a9e7d9578770245", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241349, "uuid": "228bc60c-d036-487e-82c3-c59820655153", "comment": "Malware payload", "value": "5f48d6335437d7ac78735f5bc9ecd3b4551ebeabba4fce1fb78aa105dbd530a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241349, "uuid": "ab8d7425-a3a1-434e-bac6-35b715c53872", "comment": "Malware payload", "value": "e2ad5e3c16cbec12ae6b8648759bb8d844eea368", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241349, "uuid": "e4119145-58ab-45f2-a795-c956dac1fcdb", "comment": "Malware payload", "value": "55937a376920d8fd7146bb993816d25b9666b716add778ec8e00bcb5805f432f6b497bb99131fc2f6b64d1ff5a7c8097", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241349, "uuid": "4a529366-41ef-425d-a405-1582b2c420e4", "value": "T1970112EE26A1637E0528CF18706688C47009CAC634711B1DAACA3FF29CD97093D12F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241349, "uuid": "b79195e2-f6dd-4956-8371-6d75eb71876b", "value": "6:SGKMxxKnlxKjNNIl5HxKna0LKilxKZOvxKaNI9xK9NM5xKV/B0SHxKnFL5lxKGxL:MSNNIl5x0LKHOpe4NMlSutmzjB4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241349, "uuid": "57bf684d-0304-46d0-9ace-e7d3fb144923", "value": 705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241349, "uuid": "507cc3e9-f61b-40f7-a04a-f7ba6b3ab701", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241349, "uuid": "8f00dd11-e4f5-4622-a688-1875dc0b0442", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd737c5-c257-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763234199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234199, "uuid": "95c7feef-f0af-4cbc-b440-88098f7ed94f", "comment": "Malware payload (Mirai)", "value": "bd29128624bea4ab2999b6410722feec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234199, "uuid": "fe611b15-7fab-40b9-860c-ab5624625309", "comment": "Malware payload (Mirai)", "value": "5f5d6b4b8e819934d547368d2969bc88f53fb955642a9ab45b2f0e0924984d69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234199, "uuid": "26526264-e75e-420f-9a2a-b0cd165ff26b", "comment": "Malware payload (Mirai)", "value": "584661f4d9e0df91361cf0a3d438362a0964ea70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234199, "uuid": "ddd1945a-16a2-42c0-9239-2f5112559f50", "comment": "Malware payload (Mirai)", "value": "953cb2c767a46dbfbff9b432a9efd3d8827fbd3349d0c39a7caa1cd3729623552c8987d018c4ef2e88560083668d7e6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234199, "uuid": "0a85bd0a-905f-4abd-b07b-d104b17088ef", "value": "T1F504392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234199, "uuid": "455b77d4-ed80-457a-bf8b-864a4a4d44b3", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wXUXS:7eJpJUVD1A8n0YNgEJi5aEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763234199, "uuid": "f7f2cff8-b19e-4ddd-9292-699cb64cd35e", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763234199, "uuid": "af7393bf-a8a4-42cc-b9fc-4d65cb0e1e78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234199, "uuid": "7101eb08-7948-4e08-b90a-fc7d15047136", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eb5b83-c24e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230351, "uuid": "f704197e-f5bc-4c12-aae7-8a6d8ee1d3a0", "comment": "Malware payload", "value": "fa94c20e065e63daf43b776700d243ab", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230351, "uuid": "1424179a-6f68-46bb-8fae-1a78894585e9", "comment": "Malware payload", "value": "611a74f71d239c746765928c65835d5e4c524a736f44f4eccae54d77c205d94e", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230351, "uuid": "1672bc86-0a3f-412f-ac4c-72562b7c5439", "comment": "Malware payload", "value": "ebad75314c8a9bee6feb17ef63b88bdc8a8e8c1d", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230351, "uuid": "e8613c89-8994-4a2a-8c7f-c5258554efcd", "comment": "Malware payload", "value": "6bf4094b17ef2aeb94c2b95c9a30bdc12886e4ca39d21f069517763531924199826d92620c52f9a8350f53bdfee47c3c", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230351, "uuid": "69264ffc-8f35-475c-be0e-702b2dba61bb", "value": "T1CBE4F18292CE59BA51E2A3B7083360CFAF454C5486096DE7BEC0FBC6E548743709B6F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230351, "uuid": "4a9e7402-8831-4ba2-817c-58a490134869", "value": "12288:EKk3j/ql1u8TnpyeHzKZgQOV5A3UFaG4/cxnKzMnLWDh59oAozRED4oJq+f2Hu1w:kj/lmzKZg9FFa1OKzBh5G7ODkO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230351, "uuid": "2b4894da-980e-466f-b36b-967b78661c8e", "value": 659254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230351, "uuid": "7f96ff94-e95e-43f4-ab02-eca1ed828ed7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230351, "uuid": "387fe50f-de6c-45b5-b4ed-95bce29977ea", "value": "32ea05c0f73fb8af.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e85bbd-c225-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763212761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212761, "uuid": "1eab1111-c6da-433b-8ffd-a8f63bfa4a42", "comment": "Malware payload (Mirai)", "value": "8c2996f42161e2ba2f6177652eac1866", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212761, "uuid": "2ba32c5b-41fb-4722-9a51-4e9f8605a38a", "comment": "Malware payload (Mirai)", "value": "628f01800b08c0f956b8a4dadb8037ebfe6c656327a23e3a5dfacefbeed10da2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212761, "uuid": "5f2f09da-2ea9-4be6-b91a-25c430ddabd8", "comment": "Malware payload (Mirai)", "value": "3aea4ed6064329e22995c293c4cbfcc09127f7d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212761, "uuid": "3768902a-cd98-4d09-9a98-eddbc470dbcb", "comment": "Malware payload (Mirai)", "value": "e6bc2787a4632eeed357cf80fc47748117d5a5f6874ec92fd34ceba1aaec8572b014c75eebdea111a064c714efef7968", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212761, "uuid": "1a5455ae-bca2-44f2-82a5-47be9ff5c96b", "value": "T1BC148D68FE4E78D2D2C7E37DAE4A0FA2302779749565C0B51A00929FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212761, "uuid": "6fdf90bd-0fa2-4fdd-ba32-1b1ded88b38f", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPx3:bOVfbEdxm4iub5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763212761, "uuid": "195d6dbe-2916-4331-9aab-37829dcd5496", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763212761, "uuid": "dcfaa8aa-6782-4d59-a212-b23b81c802d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212761, "uuid": "6fcb9b91-3355-44e8-ad96-0d5660741421", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566d3029-c1ef-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763189413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189413, "uuid": "4a8f67f8-594d-42e2-9e14-79abe79d094e", "comment": "Malware payload (Mirai)", "value": "66be19619c951fcc17c88d8f3a887e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189413, "uuid": "9ff3b21c-ee5e-4ff0-8d58-642bc0118006", "comment": "Malware payload (Mirai)", "value": "636503dd7f3b062a756c1e52776d7d8138979ba4bbd791e80da82753aa79a34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189413, "uuid": "263d53fe-034d-412a-95f1-efde2d69c610", "comment": "Malware payload (Mirai)", "value": "cc6314add2ac3d58d15a7fb4502167a925346e75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189413, "uuid": "9ccef057-89cb-4d00-b40f-2ed51a9f620b", "comment": "Malware payload (Mirai)", "value": "aa6b654b1e58ae3597029592f3451b32399b5d32c482513e0be76a6c6814f90e670c7b05a35608eafde4cebf47e171f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189413, "uuid": "910f584f-1c6e-4022-8675-ad7489fd0e65", "value": "T1C913F1D2F2676BD889651C72ED7C438A65DB4F38E0BE2B4254C245C235B0D4E6AA82D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189413, "uuid": "2c0da763-78ef-419e-8631-48e52ea1636d", "value": "768:9RGHuZvzhz7LaZDmWHnqR05NU4P59WI5d4PxlQHJZ/gAH2S/UXN9ws5XQxgs3Uo9:rGHuZdGQRAUM5b5d4Px+v/gE2S/MN98t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763189413, "uuid": "2e2f83f2-f2a8-4fdd-9375-a7e529dd7e1b", "value": 45536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763189413, "uuid": "0a8bb338-2516-412e-9cf1-5286e9b85d45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189413, "uuid": "c93cb162-90f8-43c3-a058-f46151666631", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7aa028-c256-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763233533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233533, "uuid": "c73a0f62-b31f-4115-bce1-7e74db28cb98", "comment": "Malware payload (Mirai)", "value": "d08ce3baf15306c0b3271d71a84e7bc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233533, "uuid": "0bb65e6f-0456-4fc7-8571-153980fa9a41", "comment": "Malware payload (Mirai)", "value": "63a6f569a0963615e2847729e363bff52c26adf2ea8f4e3e5c8647303855ec2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233533, "uuid": "93cf44cb-b58b-4987-b5a2-63e70877a126", "comment": "Malware payload (Mirai)", "value": "8c2b0b9e9b997b21d0ddcb2b021ef55364cd326f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233533, "uuid": "ecfc99b4-2573-4994-aa6a-603a890636c4", "comment": "Malware payload (Mirai)", "value": "6679ac304cfa4c3c438caff7c9774ecf58a5db12ffabd269bdb2934f5c89edec13b8ca9a530b19823ae6aa1b06852a05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233533, "uuid": "839ac131-d8d1-4a1a-8470-f5afb8c41d37", "value": "T1E2B34AC0F98B81F6C40B8C306166F63FCE71D5A94271CAADFF969F36DA77A019502249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233533, "uuid": "0ca61369-6ca1-437c-b4bc-b71f35fa5ce9", "value": "3072:XqyLpO5iL2SNPNmIrAzRzBXDtP1rGegptWsRCPN:z9OgL2mPNPA1BTJNPPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763233533, "uuid": "79321503-86c7-4f14-9057-13a7ea5bdcdc", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763233533, "uuid": "75e7faa9-fc40-49da-a481-7714b10b9934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233533, "uuid": "fb357b2f-2cf4-4bee-a22f-132acd888a7a", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304c43e4-c24a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763228434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228434, "uuid": "35ecc64e-4b53-41e9-a6d2-951d9d56f929", "comment": "Malware payload (Mirai)", "value": "30c5984bedebe20cfe1d0ba15e885d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228434, "uuid": "4507007f-5323-4b57-a413-5100592dee3f", "comment": "Malware payload (Mirai)", "value": "661474ad889ca5723e933b2dab92619d8c5a410233ecf42cb006204e83f2ede3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228434, "uuid": "aeb3c38b-1bf7-4b55-b6c2-dd50884845e7", "comment": "Malware payload (Mirai)", "value": "d0de578ea62d62d2a82aa8a81c58dc11b6abc5d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228434, "uuid": "e59dc87a-34b6-4a97-b8c2-1119b428dd93", "comment": "Malware payload (Mirai)", "value": "2e9467af769ad74e2e48234b94cb9add74e2a495ccd97bc2bec9ce7f55b4d7bb28d8e397e2630de95f1d33122c917eb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228434, "uuid": "d6f1fc6a-9ec5-4e27-8ab7-4c1af84e8503", "value": "T13224B70E6F228F7DF6A9833447B79E24975923D627E1D585D2ECC2011F202DE641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228434, "uuid": "e027bbdd-c332-4125-b553-077ce45f81b9", "value": "3072:7LD96jMCX4tFLS4WsqBYMvvhiWk1JIxrnbUPYjaRC8t8hp:7/96gCotFLS4WsqBYMvGgEPFRCg8hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763228434, "uuid": "f34e9497-e6c5-47ff-97d1-bfe3350c6f4d", "value": 223032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763228434, "uuid": "65061af3-2601-48cc-9b63-30bb1a99e4ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228434, "uuid": "bf30e656-f5cb-4704-b2be-96fc91b573af", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0ee30a-c24b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763229074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229074, "uuid": "bcdca4e8-b48d-4a86-bf23-c511daf7ea33", "comment": "Malware payload", "value": "690015c0f06517235572283a4cfa182d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229074, "uuid": "34471b2b-8c10-40a7-9f74-48abfeb958f8", "comment": "Malware payload", "value": "66ca60c1d2d74f1797b54e8ade32514d7cc58d1ca89ecc2a17333653f6fcec79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229074, "uuid": "2b3fe8ae-589a-4999-8a8c-8832285cdd8a", "comment": "Malware payload", "value": "f62531a5d923775a06775b19bef94e466db61cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229074, "uuid": "cbc5f474-aa5e-4c2b-b3b3-5dea53d5e510", "comment": "Malware payload", "value": "d8abbef85c938ece3ee6c9126de1c962e3c0b536da893cfb5c21f4b175e93599e740ce226bf0ba258639ada1d53ac850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229074, "uuid": "48eeb5ab-b6bb-4305-b53f-c38d6de54143", "value": "T193F75A4267FA04C5F9FB9A3499E65213D673BC066F3085CB324C172A1F736E099B6722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229074, "uuid": "fcf23bb5-d496-469e-a8b8-949d10fa4488", "value": "35686f86a183dc6a9ec694033bf670c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229074, "uuid": "f4332121-b6b7-4ac0-a66a-22b5324b2f5e", "value": "393216:AfNi8x+zds3HSSf401gqNQK5plBRVz3xWE+xQSI8w5SvDazn1d5VRYv4LWoaM8+e:AMdCJmQlR4Vu0C1SpgPVlcmLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229074, "uuid": "ad2c1f34-423d-4b81-accb-0539d53c4fd9", "value": 73156360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229074, "uuid": "9ab62293-1708-4e1b-a479-4dcf6a7897ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229074, "uuid": "a071b8d3-83f6-44c2-8614-674fd84f47e1", "value": "v1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06ef2a1-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239896, "uuid": "1d32bdf5-c0ca-4f40-ae93-b3fcc7e541c6", "comment": "Malware payload (Mirai)", "value": "7969c45b29c7b69b47e2ce4f170de3bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239896, "uuid": "6ede3294-76e6-4b9d-9f76-79fe40e1134a", "comment": "Malware payload (Mirai)", "value": "66e5e082241ef371271bc18a5f4ecde91a71f81d0a54998310a0b554f26991b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239896, "uuid": "76974668-0aa0-4d12-b352-ebb30bde554c", "comment": "Malware payload (Mirai)", "value": "ad6667a4164b46060534ef98c3aaa319b05fc483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239896, "uuid": "e5d06eb0-07a7-4afd-a5d9-4d8162b4bbee", "comment": "Malware payload (Mirai)", "value": "ea0d0eaa51bbee7d106e0c230eb3d16ea10ab5eb985de44d1395b139b6fb5e53c63a8eb16ebc6be2a169d87c6d9d9cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239896, "uuid": "787e10b9-0f7b-4e11-b2b6-72a0bea23ba6", "value": "T19DD35C0673180F17D5A35AB0263E1BE083FEE5D021F4BB89651F9B6A4672E371582FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239896, "uuid": "076ea49f-94df-4ff3-82c4-9961f786c294", "value": "1536:mom472eUS/FXyFQ+16G3m/2kcVJletL+X8s3ZrAUf+cGEr9/ofByxZuoNrqqG1iY:5XUoyzm/5sJYL+X7ZrAUjJR4yxZ3VJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239896, "uuid": "b2e559ef-0c30-459c-9007-5e93821d9750", "value": 136760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239896, "uuid": "01b96bc9-f479-4e34-b46b-cb9c22683158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239896, "uuid": "1fe068ad-57f4-4af8-bbdc-2502ae8e1038", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba56a93-c255-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763233472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233472, "uuid": "15e84936-7131-4d28-87f5-14d710a01f65", "comment": "Malware payload (Mirai)", "value": "b1224493ade02f30b50d4f0406f1d1f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233472, "uuid": "5ea862ce-9494-46df-9f14-09a3adbf02fa", "comment": "Malware payload (Mirai)", "value": "66f67c3960faab5dafa836ccaf9bc63733dc49a84e972fdd81bc47c45e6eb5fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233472, "uuid": "71b8638c-dad0-4570-bb17-37a6a3f86d84", "comment": "Malware payload (Mirai)", "value": "d820def5ca7dd49d9bdde098d511a9aceeb78ebe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763233472, "uuid": "94724604-6f47-4a61-be8e-299624887ce3", "comment": "Malware payload (Mirai)", "value": "6f704a0a9ed46df48d850f0a6ef1c25b7a89ff3d8033fb1325fdf24457673f26b7dac07b135df5ec9e222ebfbdf29ce9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233472, "uuid": "cee3a531-957c-4e3d-adf2-deb6b5d762ee", "value": "T1DB23F1C989AF538AC5DBB2786A9C384E1D1C961A640DC9779F8C408DC18EF32155D78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233472, "uuid": "438a129f-ebbe-4dff-8cf4-8b8646efc4f6", "value": "768:VMxa+Kqs+LOBSx4rVzFHqZD8VPIRfQWyvq6z1vOi1H31/vr5dGQmUoxym1Jnbcuu:ka1qsBXrNFGyPesquH1HVvr5OUHm3no/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763233472, "uuid": "388b8024-9f50-416b-b23f-6662cb05814b", "value": 46912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763233472, "uuid": "f843b7a3-4b41-4b08-a2f0-8fdbcee6294d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763233472, "uuid": "15aceec3-5286-469d-a627-f4281e9fc25d", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da699a15-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239886, "uuid": "a68b96d1-7c0c-4604-8298-d3c13007a033", "comment": "Malware payload (Mirai)", "value": "012a65851153d7e486bc636b5a1948a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239886, "uuid": "e2a6dac1-08c8-4765-988c-bac8495a98c2", "comment": "Malware payload (Mirai)", "value": "67cf96626e3840e3d43bb2ed474b6aaffadefc4387d46162766025ec5b443b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239886, "uuid": "7cb06ad2-0a4e-474d-9cf3-60b5689c0dac", "comment": "Malware payload (Mirai)", "value": "8c3a32b63cbb5059b1018b2a5ef296684281630c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239886, "uuid": "1f23978a-9c8c-4963-94a7-b1d1ed31f59a", "comment": "Malware payload (Mirai)", "value": "83b21aea7b68e44ce33d16972bc594a97b133c1cdd4a9fa40098052f0182334c54949ce06da1ed19acf231af687c5f1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239886, "uuid": "3c8e6967-8e61-4d4d-a790-497704e448bb", "value": "T181B339C1B643D4F5EC1641302277F73B9A32F0791239DA97E7A49E327C92A519C0A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239886, "uuid": "068d1bfa-d120-4b76-bb5d-d7cf16abd144", "value": "3072:tbcWYdCLFaGFhu3/45g1jcV2w+NS+AMFfpH:tbBYdoYGFh0/45g94upH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239886, "uuid": "40a0ca4d-afb4-4bfc-8b35-9c43f2391044", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239886, "uuid": "2b0b933d-ebd1-42d7-90bd-5bc65a2beb51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239886, "uuid": "6a279c4e-c9f8-4afb-b3ce-0b22e8b15d33", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b041ae6c-c24e-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763230366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230366, "uuid": "f8fb1c28-ec77-4f31-b572-b1cdba55d4d0", "comment": "Malware payload (CoinMiner)", "value": "6763bf15418c652fa1e79dcf2b7286cc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230366, "uuid": "1096bbd5-16d1-405d-893a-3b56ea637797", "comment": "Malware payload (CoinMiner)", "value": "683a32986709411c660202688018f16c0dddb09010d0af12325aaf8c00cd7997", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230366, "uuid": "8abe3c85-955f-4941-9496-e3733e151a67", "comment": "Malware payload (CoinMiner)", "value": "ba68318cca5307b5032fa2e77d772483717f10bf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230366, "uuid": "11d92eaf-8ffa-45cb-82ac-4baaed643eb1", "comment": "Malware payload (CoinMiner)", "value": "5b055ef1a2805d14209ae91b85673c9509fb86702c2d3a29a68c912a76edf1f1e82a43fbad458d1b9da48b2f5b4342b1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230366, "uuid": "097b5d06-4421-4aa6-9cca-c982135e27da", "value": "T15766117DF2B71D20BAC7A665C0FD834508C09E877B4B2369613BB9D460648F43B6D93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230366, "uuid": "017efb93-ad12-4059-a894-8e88ab9e9f28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230366, "uuid": "dcc73d67-f3a2-4c55-bcc9-8ac0c5bb0636", "value": "196608:6XjUXSksRpixYqofAsYrXr0CRTWAfvSFJ:6XjOuq2AsYrLWAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230366, "uuid": "ac3c4cb6-4e2b-492f-b3d4-138f38388a53", "value": 6921728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230366, "uuid": "1d603452-41f5-49f2-9e64-06903e4fa19f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230366, "uuid": "fb06b668-071c-4add-8b4e-76884f66f96e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2ddac2-c236-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763219916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219916, "uuid": "73c22f7d-826b-42b1-a45f-9b43df800d72", "comment": "Malware payload (ACRStealer)", "value": "87b1ee2d4b8bfd4702d1e1970b7313bd", "object_relation": "md5", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219916, "uuid": "65f96670-c784-4d09-9215-9db6e66b7147", "comment": "Malware payload (ACRStealer)", "value": "6914a2997aa01223701c2ee1e8bf49807cbc333253c7e0f01f468f8c12a9c2ba", "object_relation": "sha256", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219916, "uuid": "9ad09ff8-70b0-4efe-a54a-01d4ca1a76fc", "comment": "Malware payload (ACRStealer)", "value": "7c0ea885f9113f7a74e8e8e31972ba7e86a22948", "object_relation": "sha1", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219916, "uuid": "ab035d11-3c66-437d-bb59-5734e8b3563a", "comment": "Malware payload (ACRStealer)", "value": "d5347950750b5aa76da45e3f12f2d96875869b2f89a9d7d0dd6b669144da00b4e30782b8a88ab1e52c3f389f4ac0053e", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219916, "uuid": "b50fc677-c59a-4be6-be3b-e35975f0e025", "value": "T1952733BDFDBC6AA7F460D072A7150484C144B116AAA7A131386F24E35D4BBE333EB746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219916, "uuid": "706e6318-94db-4c0b-bfd6-4dc4a9449e11", "value": "393216:1qSxdqk0ilC8aONZXyqhrNyxEaNw3kqZadtkgGH85JHW6CyLJP0tmsNgckgL8vJ:DHDlC8zZXyu5ZiwzqtbGwHfPZsW1gL8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763219916, "uuid": "4a7262d4-9756-495f-b1d0-a2decb0a2bcb", "value": 21978740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763219916, "uuid": "1207a23a-68f4-40fd-8bed-4200585523fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219916, "uuid": "5b344604-812f-4810-82f0-83515cce62f0", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6f8755-c22b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763215113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215113, "uuid": "89c6f6db-b496-4811-85d3-91222317a34d", "comment": "Malware payload (Mirai)", "value": "809fc2142d59a5b830eb28defd0ee16c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215113, "uuid": "3b98d89e-2109-4a43-ae20-a889108ec44a", "comment": "Malware payload (Mirai)", "value": "6bc4101aafac05c1ff82c5a7af8693ac76f9c3b9be3da3497dda90f28b877f08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215113, "uuid": "42c698a6-eec8-42da-9ce1-7730aecdd166", "comment": "Malware payload (Mirai)", "value": "30bb0790eb03313aa46de169f892ea0edec254f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215113, "uuid": "481ad523-576c-4df7-b397-d6899a221ed9", "comment": "Malware payload (Mirai)", "value": "04d1d716afea38fddddf33049cb278ebff89c0736413143cca2d3980cc11ee5ee12b22b208feb365b61459595644cd2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215113, "uuid": "d91c6f63-130b-4d79-84a8-47213a419924", "value": "T125146C2BB3C3ACE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215113, "uuid": "95536f94-e9e2-4302-8bac-8891e281ca54", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtb:BZAyFzQSdS7I+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763215113, "uuid": "08b5a182-0bf8-4df9-84f0-b89dcea1c7db", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763215113, "uuid": "aeda4542-4b6f-4974-8bdb-09c9811bb9d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215113, "uuid": "6431c1c1-1261-4399-b9ef-31f24b3b87f9", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac606181-c22d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763216186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216186, "uuid": "7985edac-a34c-4aa4-aba9-23ee100d1fb2", "comment": "Malware payload (Mirai)", "value": "59f2f40f89b7228bd1f9493fdd576c81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216186, "uuid": "af1a20d4-91ba-46cf-a46c-a788f31dd7ad", "comment": "Malware payload (Mirai)", "value": "6c84264dc1be79229d17f3c4c7f55421ff198acbb1e0a0b892cce76f9d65ba0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216186, "uuid": "af6fa0ad-e462-43b7-8e54-b6407234f072", "comment": "Malware payload (Mirai)", "value": "a0c3443f3194a061bc9f8aaabd9285d9d0fb9882", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763216186, "uuid": "0bb819f2-6b58-454b-8125-93a76a04b7b1", "comment": "Malware payload (Mirai)", "value": "07f8c6afce393ff414536c2425de3c25cfc142b980fa7f89da669c146030c3a29e11b4242af26ca5653c7cb7b0e80f88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216186, "uuid": "c0093c2b-2aff-4c2a-b88b-0691ae23def2", "value": "T1CF631247FFDC0FECFCDA2AF807AE699E23519035647342A40DD65885809FAB1249ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216186, "uuid": "ea0f73db-30cc-43e3-8e5b-20be23f1ae17", "value": "1536:27MbwKNGjjH+Xq34n/q8Zu41zmX3sDgnz2ggrP2:27Mbp2L+Xqdfoz2ski7rP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763216186, "uuid": "fad7dfcf-8085-4a10-bdc0-5b26097f1249", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763216186, "uuid": "69dcf62e-3f31-40ec-840f-79f5bf2ff53c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763216186, "uuid": "bbf023f9-fd47-4a88-946e-3398ce2979dd", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d066ed2-c259-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763234924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234924, "uuid": "a90bb69b-233b-43a5-82e1-fac4fa7fdc67", "comment": "Malware payload (Mirai)", "value": "473f46a08076f702f68674db81b05a45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234924, "uuid": "0c64d8ec-76ca-4b60-9de9-80ab4e197e17", "comment": "Malware payload (Mirai)", "value": "6cf33ef541f9f846fcb82cf6e18919abcd1e72a5e83c000f00372d86bcd411e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234924, "uuid": "59fcb798-3840-4a19-9f33-5356ab47ed38", "comment": "Malware payload (Mirai)", "value": "22659a1835c8b4e46e4f3d04b5a3978b6989f569", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234924, "uuid": "c1ab0000-a51f-47e9-bc47-204e72c0fea5", "comment": "Malware payload (Mirai)", "value": "b8d7089593e5f5f7740aed953fcedabd695a1ded42dc4d50b20b0f19924641e661aae9feddbd2c73c33ee5394de2af28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234924, "uuid": "8bc71f7b-4f24-43e6-8be4-58af37e07888", "value": "T104B57B077CE158AAC0AA93338AA691927B71FC4A0F2127C73E50B77C2F326D46D79754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234924, "uuid": "66dbbd40-fd97-4f41-a7ad-9c9dde40d3e1", "value": "49152:NoOvwZMaXjYVT+XpF1GsUzSS+HRVozRvGFrDGB:Nn1as6pF7JnVoz5GFrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763234924, "uuid": "2bdc5eb7-fd04-4043-a40c-36a04747998b", "value": 2446265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763234924, "uuid": "d9cc1c38-4091-4c35-a57a-f663158d3282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234924, "uuid": "6adeaae8-346a-4b23-9a9f-d7ec8f1dc93f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983accd2-c226-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763213146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213146, "uuid": "a748512b-1e01-4b8d-82d9-5ae11b0fab1b", "comment": "Malware payload (Mirai)", "value": "411d3b82092f68a66c014334a7e8a583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213146, "uuid": "28b8bc05-6d6d-4e09-b53a-ac35a22222ae", "comment": "Malware payload (Mirai)", "value": "725ff5c1770c5241bb0e5a0f212df5aabb76eedf81c64e83bcd072f991a06fd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213146, "uuid": "dce2a839-5362-4eb5-a86d-19c5a52236ed", "comment": "Malware payload (Mirai)", "value": "c42515aff89cfc7ac75ae9130cf630dbf28acc73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213146, "uuid": "5222a73f-9d52-48e4-a639-4d23868fbe0c", "comment": "Malware payload (Mirai)", "value": "abe9b73c0cd1cb64d234cf8ba066217b394f010a83a7118b6a8796a5ef42de99d42ed50abebc38f7b9e83e1fd383a51e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213146, "uuid": "f6a2bcce-ddb4-433e-9de4-a96321c3fef2", "value": "T110435BC6E603D9F6DD490B7410B7FB32567AF1360119FA8BEB99E53AFC42601A50638C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213146, "uuid": "d6ccd328-1d26-4b4b-b3da-dcad84bcb7d1", "value": "1536:MXq3PGS6wcof1RurbGtfStv0SlYdVa6kW77pmkEOP+bRR:MX8Ph6wcojumtfSt8AcHvm3M+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763213146, "uuid": "c0ff2cec-7e15-4b3b-8a59-5fe256ff59a9", "value": 55812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763213146, "uuid": "cacb2f56-ce54-4519-9da8-dec0f5d21289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213146, "uuid": "81fec783-48ef-457c-87bd-efc5c93a2693", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde76e51-c1bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763168220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168220, "uuid": "9f94e04f-3433-4108-9228-81fb5ec279d9", "comment": "Malware payload (Mirai)", "value": "3e966f516a2f19f86e0fa8e08408e8ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168220, "uuid": "2182e768-b85c-40c4-8298-d4f6c5992b9a", "comment": "Malware payload (Mirai)", "value": "72798e212de8bbe3bd4c65dd11d6aabcea737d08c725bfa05e176ce252c3c622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168220, "uuid": "179602f1-4eeb-4a25-ac19-4d5c180cc9d2", "comment": "Malware payload (Mirai)", "value": "aafb27de42272e29137e8e0821b3ffbb76814201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168220, "uuid": "41f71679-9e47-4795-9c94-530855fee097", "comment": "Malware payload (Mirai)", "value": "bed30e3f039cfce444fbbe78cc94c6cc2d31b0a065a73f0a30b4373cc53cc3441acd0cf1f5239b56adf4b3adbb935f49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168220, "uuid": "31607276-f4f4-42ec-b271-9d7d9c35a715", "value": "T1FA13F16CC3180EBBEFBB56751CAC829237F09E519765DCC254C69CAA211312ED082EA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168220, "uuid": "ad552470-3b87-43e4-bcc4-3639190288ca", "value": "768:N/On6u30Ddt70TvLjvCXoHWkZnu6TMqaHEKDfogc50VkeOhcdDbSMSJQ7Wd4uVc6:NWn6oa+ZnkqiKgPXJFSMSJcg4u+qgw0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763168220, "uuid": "0ae5de17-cac7-4451-915c-8388dbf00a9a", "value": 43588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763168220, "uuid": "85294e75-bfd9-4c9d-bda1-415e8d23582e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168220, "uuid": "15254c93-76f1-47a5-9346-c6dbd796f693", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0c4d44-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230925, "uuid": "8e24248d-1ab0-4c0f-a92d-34ca46dfa31e", "comment": "Malware payload", "value": "d8032a70105bf003a0d73e80c801a227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230925, "uuid": "7886c992-9b37-4103-9900-b17afa69ee61", "comment": "Malware payload", "value": "72e46c4bb14985ea3efc7a44b00aab5ab8f53350701a15de7d209f2fc85727f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230925, "uuid": "2c3bd24c-e2ae-49ba-abed-b1ecf96de13b", "comment": "Malware payload", "value": "8adf07b6f2d477902ac12dca533ddc992735fd4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230925, "uuid": "3f4bb199-ae91-4c07-bf20-7f45bc8599bb", "comment": "Malware payload", "value": "413a2ab69bc19257b6b0b035cb68753cb997ae76f9b8ea4a062bf99f29d86222409ed95796de95f670db76845097dcaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230925, "uuid": "319610fb-bafd-41c7-ba17-07b02379c087", "value": "T1E5B5AF65ABB420F8C56BC13CC9735517EAF2F4551360A7CF07A0C6A62F237E19A3A391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230925, "uuid": "b4e4c518-ee4f-427e-b7b4-0431a1b01dee", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230925, "uuid": "fccaa28d-0840-4166-92bd-a84da6c6e13d", "value": "49152:fcf13mS5Az6MuwHCjiDP4qI9cQKvFzVH20vDnAx:f2Mlz6MuwHCjiDUCVH20vDng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230925, "uuid": "e0a76463-a520-48a7-8cb5-938b72690139", "value": 2331476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230925, "uuid": "0b2a9a3f-9e22-4ca5-aa22-059f2c619343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230925, "uuid": "1dc5134a-8ce6-4f24-b00b-f3edfd591100", "value": "4bhnwo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59777f50-c252-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763231939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231939, "uuid": "25cfc770-31c4-46b6-a05f-0cedfdd4bdb3", "comment": "Malware payload", "value": "53c19ba65e6383d2cc0add81a06cf36b", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231939, "uuid": "e55df527-c056-419d-a792-212de7220725", "comment": "Malware payload", "value": "73506f24a6ed3551497df7ae00ccba8035fd71c51bfe5d3df1d162022445ac64", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231939, "uuid": "844e4274-2e77-4b41-9e4a-068a62c87634", "comment": "Malware payload", "value": "a3c5e2695593899e21ceed990edc04b2bc328e18", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231939, "uuid": "693df4c8-ed85-48d8-a6fa-ae7a7a97c5c1", "comment": "Malware payload", "value": "f9cbab8e42dc647ace82a1fc336a62943b0454afd95c3effafd24b1b082ad045d35f567f96592f935a240b4bb26383f8", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231939, "uuid": "b643fe6d-7086-4cc2-88b9-7f5d6d33706f", "value": "T114D4F181529E50F512E2E3F61FB3119EFF644D004A8A2CEAB7D0EA87E545A1390E77D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231939, "uuid": "fdd28517-8b3d-4914-9503-b715bd179f98", "value": "12288:kAvvRImy6/F2lOeiXiQXfSZ6iGTdE3eg3DyCZr5I8KfD9Y:kAHemz28h7XqsFdmZWCZG8SD9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231939, "uuid": "080bb072-ca12-476d-8212-9bfedfa12813", "value": 605554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231939, "uuid": "ac2522e3-509e-415a-b04c-87493c0215dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231939, "uuid": "b4aa6991-b6b0-4774-ad3c-c01e5842724d", "value": "266032fb98453a01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9aaff00-c1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763171997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171997, "uuid": "a1dd8327-574c-41ab-896b-66d9f4109f16", "comment": "Malware payload (Mirai)", "value": "ef2e128f7b1438d302aefc73c2533ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171997, "uuid": "53045dd7-88c5-4a78-9f2c-f494b6bb2a8e", "comment": "Malware payload (Mirai)", "value": "73739db5594a659d540defe2c495d50f49e87038a3dbfaf70de8d908480e7217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171997, "uuid": "dbf760c2-0f39-44c6-84ca-3f2b95071e5c", "comment": "Malware payload (Mirai)", "value": "ee867c36b05e927ebe7a5a1e1e2b4c532bbe3aca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171997, "uuid": "8351d3ae-7b5d-41e1-a42c-061b5f4736fd", "comment": "Malware payload (Mirai)", "value": "b7c851d9a6a85e74c50c18e0d05138f4a708e0a452635780d089fe34f97c62bc95546de7fe95571227469f845591e1e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171997, "uuid": "6c78ea1e-d2a9-4442-9f68-766cdeecd934", "value": "T1EAF2E18218BC4108C16B11B91C67FDCE88A099A5D5A885E60F98F523EE17FDC396479F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171997, "uuid": "296e8a4e-38bf-4874-a504-1f03c046b96b", "value": "768:WCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIp3p0/emcnbcuyD7UHQRjO:WBGbyqhXrTBrQX4oEA/evnouy8HyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763171997, "uuid": "3d5d3caf-36cd-4e1d-9477-9cdc11444130", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763171997, "uuid": "ca3ac61d-a2ee-4046-bfa0-c36589731296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171997, "uuid": "4ad721e8-bac5-40e7-b6f1-1fa29bce0ed2", "value": "camp.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8ede20-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240750, "uuid": "5f6939d3-1529-4606-9708-19a93e1ff705", "comment": "Malware payload (Mirai)", "value": "8b604b5a4e3d3d93ac05fe5f84a80a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240750, "uuid": "32672e92-9751-42c6-94cd-4faff2545dca", "comment": "Malware payload (Mirai)", "value": "73c5f0ddd07ce2adf7327d956abb1c1e5b25471d4743acc42b7a373a19763fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240750, "uuid": "1a8359d7-540b-43ac-a579-59f9f722092a", "comment": "Malware payload (Mirai)", "value": "555ea044458f3fd32127254e98ac4b1d4a2f8534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240750, "uuid": "92ebdfe3-fb2a-4bd2-afdf-629ca193f60e", "comment": "Malware payload (Mirai)", "value": "fe6fa85d84e9aaa77311f5d78f98bf868f5117de857caa6026f98fb73a8c1cddf340828e85c9493138bad40676bbf4ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240750, "uuid": "7684a739-553b-4cf5-90a8-e621f8ca8c81", "value": "T146334B42721C0E17C0A35974253F5BE487FFFAD122E4F6452A5F8B668A34E371489E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240750, "uuid": "b027dfe8-6990-4828-a943-c006c6da6538", "value": "768:kZvmOb4IE9mhRCJbNbHxTORx3rofyaK/xwy6FRYPm9KIj+MdQIWQqwy:0AInE5xTuxMfLoxwyw99rQIrjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240750, "uuid": "73461d89-ad39-4c2f-a674-5c75776b8889", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240750, "uuid": "36741128-db6c-4606-b80e-c5fd3ae1db71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240750, "uuid": "168229c1-83e4-4752-92a7-c6038bcdfeb8", "value": "brichs.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1330287-c237-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763220490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220490, "uuid": "d33da0d0-b82e-4ff7-a077-bcd69fec9e22", "comment": "Malware payload (Stealc)", "value": "f2a079af4f58801cbf7cf4b95690fb1b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220490, "uuid": "cffff880-67e4-43ae-ab88-09a103ca5072", "comment": "Malware payload (Stealc)", "value": "73cb107e18c95cdd214cc8c937f336808247acd9a0d087d504b4f9b1a37183a7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220490, "uuid": "0a2b8774-7f17-481d-977f-33fd1bf855d0", "comment": "Malware payload (Stealc)", "value": "31945739579bf4cdcec778118fc7860259c9c250", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220490, "uuid": "6a553d23-4da1-4da7-bda8-3a5aee9fe82c", "comment": "Malware payload (Stealc)", "value": "789014de7ed9b9a884127892ba520bb143ed6dbf2c1cd65777d4000cc5720aa0b699b4cda2a4884bf84dffc34452b816", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220490, "uuid": "2a133603-e510-4d3a-ab63-95dc5b9758c2", "value": "T19C4423FB6A0C9D9FC09482FCC90D2073A77A7914B6CAA3AE54475FC1A27633C654D788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220490, "uuid": "f32c06a3-07f1-42f7-b666-6011576309f6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220490, "uuid": "1423c1c6-866c-47c4-bf5a-34401f73c222", "value": "6144:pbVsNI1ixw+sB7sjdj2j2yfdBJk2x1V1ar4tbc7k+Xm:heOKw82CyvlfV1araw7k+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220490, "uuid": "d1fe739e-82da-4097-8d5d-f01631118786", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220490, "uuid": "a1e679b3-ce52-436c-a245-f0331d3c695a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220490, "uuid": "48de8a4c-ffc6-450a-a1a7-29127835bd49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4946a331-c1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763185526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185526, "uuid": "b413d487-0ae5-4891-8db8-0d33fa1f43ee", "comment": "Malware payload (Mirai)", "value": "25c10eff8d37a67afc30e0a2399ca44f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185526, "uuid": "bb254c1f-3479-4c32-8596-ff00c45c47c1", "comment": "Malware payload (Mirai)", "value": "7448183674167347f1123070d12359164d5c896e23eb58cf66de17027e0ff078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185526, "uuid": "e7161ae1-44e9-4dd8-8e46-77dc68b2e668", "comment": "Malware payload (Mirai)", "value": "47fcc97f60d6ee5cf8d24db5468d5cd42ab13b9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185526, "uuid": "4c0a06b4-634f-44a0-9a85-e02abcbceda7", "comment": "Malware payload (Mirai)", "value": "78390524a946041776d1e30ad6e625677d518fa3eccd9730ecc8116c1932f9741b160e7c35670e768333d518c6cc6504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185526, "uuid": "73b00633-f17f-4f36-a2e5-d36efc1e27e4", "value": "T19B23F11B120580DBD581C8F406E9D3A1AD740F6BA02B88CF75CA85A34ED97513FD29E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185526, "uuid": "72431cbf-fe91-4f89-9cbc-938d145c1d7c", "value": "768:irxDXaa0/PqLz3qqQe99yBx7UG3z03vcaGnXkmNXqmauTKJgGlzDpbuR1JE:irxDX8aLOqQegB0ftPmN6mauyVJuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763185526, "uuid": "807e6757-b5b3-40d9-ab8b-5c1328ead21b", "value": 46848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763185526, "uuid": "aa9a9560-691d-480d-9dca-154a259182a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185526, "uuid": "11c7a4db-50f6-4fbf-98ed-cf61f16a1ee7", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089033cc-c24a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763228367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228367, "uuid": "daf7daf1-63d4-4f88-8160-430669e28642", "comment": "Malware payload (Mirai)", "value": "4ed0cfac837188c2465fa19bb945d813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228367, "uuid": "0f35dc38-6f16-406f-9285-63a0c1bb202b", "comment": "Malware payload (Mirai)", "value": "759b7b535e312929274b186c9baa02472a9cc3731e56c997c8fdf401a7dd9a61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228367, "uuid": "432cb54b-1799-4caa-adb4-4491f43b8870", "comment": "Malware payload (Mirai)", "value": "08eeea4cbdc367f611a5ad03eb353f7495ae0dde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228367, "uuid": "390f0cc2-ba25-4a97-a814-c507b3abdf30", "comment": "Malware payload (Mirai)", "value": "1ed4134b7df306eccca9a6e9e1f7785ba86bfe875373a2b0457b23cb37a2de103c08d061cc4d824b89e845c5ed27acae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228367, "uuid": "4ddcce8f-d293-4be4-889a-227bcabee806", "value": "T17E6302EBA7F02D428E3189F8F6B591C2DE0691E070EDB0161E68437464A3594EDEF827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228367, "uuid": "cc82aab8-e110-44fd-8acc-879347bd8476", "value": "1536:uUiQr365EgyNFsyfn6Hz+CKPPyoHRqIwgML1yJRZKa9BC0O:udg65EHNFse6HzMqoHR5ML1sx9BHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763228367, "uuid": "6e555b0e-2281-4dcc-ba3b-f1a9770305da", "value": 73052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763228367, "uuid": "4a320a76-79b5-4c40-8c57-2f79213f1fc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228367, "uuid": "b000aeee-91d5-4a4e-838a-71fff2e8010f", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fc8081-c1de-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763182007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763182007, "uuid": "43d0e410-c271-49de-bbb8-265ee1e5cc21", "comment": "Malware payload (Joker)", "value": "8513ff328d93c192e95ae54700d5568c", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763182007, "uuid": "f7cd525d-58c1-4db0-920b-650cb4b593b5", "comment": "Malware payload (Joker)", "value": "762a1b9d3827663e6c7661ddad68388cf80ff07fb9ef2ebe0b9f2c9363e625b6", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763182007, "uuid": "b19d67d6-c356-4a09-af5b-580a6a8d6dc5", "comment": "Malware payload (Joker)", "value": "7e05886f2a95ad194477fdade3c0cd5edef6fd7f", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763182007, "uuid": "8ad558b6-ee14-4f28-815a-b8ac789a51e1", "comment": "Malware payload (Joker)", "value": "15814b36a586ee1f030651a14bc1a4344f30d81974da95ba9d7f5b4c23127f11e5505b6199198ccb892a13100a5f4434", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763182007, "uuid": "a13f787f-dfe7-4591-9aa3-2b7b4972c664", "value": "T11637F14DE10CEA36DDCAB0BC8E890653B1163C4557A5C2853916F20CFBB7BE44B66B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763182007, "uuid": "4e548ae4-97a1-4c69-9a15-924c0516a4f8", "value": "393216:/B8yaNRoTFWuX2zK1Eo6T6i5/6Yf959UmgdDgDJ8t1:myaNOTkuGzYGZ/t9nGDgDc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763182007, "uuid": "4fe9c867-d985-49da-a01a-d6874c62204e", "value": 23191709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763182007, "uuid": "ab17b8d4-0774-49e9-8152-8089165ecc24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763182007, "uuid": "dd5123d3-de74-46e6-ab3c-e5a23838e4c6", "value": "Face+Photo+Editor_7.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150e961d-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230535, "uuid": "2767d5da-24dd-4e3e-8900-3916723dd309", "comment": "Malware payload", "value": "5433243ce09538effc8e710b0bf5e887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230535, "uuid": "db3c27e5-704f-47e6-80c4-93b292042a0f", "comment": "Malware payload", "value": "766f213c827b710bfb4966e694adf5297bb25c6eb7d3df9db8609548c3a5f073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230535, "uuid": "bfd528ee-889f-4d30-ae30-a1e4b62b3f43", "comment": "Malware payload", "value": "c912a6827ba9a318590c9a7bc1fa8d914fe61352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230535, "uuid": "f88f208e-76eb-42fa-9a2f-2d230900f27a", "comment": "Malware payload", "value": "ae2567d762e3694423764bfa1195ff2d53ddda4ec61c9c5ca50af845aeddf72f7dd60b2c6feb7eeadceb31457be8d85d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230535, "uuid": "bce568cc-464a-4542-8411-8fe63aff0231", "value": "T1E985AE5AA7B410F9D5B7C178C9524607EBB2B8461760E7CF03A08AA61F237E16F3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230535, "uuid": "2d5bc01e-a3d6-498c-ab56-a0ae8622dca3", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230535, "uuid": "b5ff038e-3bcd-4568-8a38-2578f2f09041", "value": "49152:QGCi+BkxSMDaAtKb46SymE2Pmf1ngvVH:QlvIDaAtKb46Syxf1wVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230535, "uuid": "56793fee-1f81-4b24-b09d-1e9582af8b6a", "value": 1756672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230535, "uuid": "0fcfc9b3-24f1-4487-98fc-8ab4dc5e9f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230535, "uuid": "7c87d946-20ca-409f-98c5-7b6c4ba209e2", "value": "nrr65m1d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf9c2b8-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241528, "uuid": "692e5f34-4b4c-44b2-b8ff-997cbfb9c132", "comment": "Malware payload (Mirai)", "value": "30419c283baaeee6ebb1140b2b8d807a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241528, "uuid": "7d3dd431-5fd7-4ae3-b60e-ad95a5bf2bd5", "comment": "Malware payload (Mirai)", "value": "76a151de07cea965b0320057263aee27eaa4ec57db4f8db1afc59267e305c1e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241528, "uuid": "81fbe45a-da06-4abf-9c49-ae522eaf3d4f", "comment": "Malware payload (Mirai)", "value": "91496bbebe99f0124f743a4bf87cb8a4c3ca0b6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241528, "uuid": "faa61df2-51af-460c-b4e6-ca1c3e250b0b", "comment": "Malware payload (Mirai)", "value": "5f353613afa77b88a4cc321101328ba313620af0430c7cd5a8d73f6824f6d861dcba13aff23b2df52f3e832750e0d741", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241528, "uuid": "df5f61e2-2818-4feb-aedb-fd35eb29b699", "value": "T185E32B56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8279B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241528, "uuid": "52bb1c8f-b69c-457a-a8bf-668be674b037", "value": "3072:eJLce5p0Ad7xS0aCHbz4NvMLJF1IQ1FsEXMk/M/9gQkY:eJLcGlg0aCHbz4N0LJPHsEXMcM/9TkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241528, "uuid": "44652fa6-aac2-4201-8a62-ca8acbe838ed", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241528, "uuid": "b76f8740-2393-4028-b9a5-e5d37f75b15b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241528, "uuid": "201ac177-4ad0-4855-a46c-8601641e0c41", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a01ce7f-c271-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763245147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763245147, "uuid": "e1dcfaeb-915f-4bf3-9969-0020786aec45", "comment": "Malware payload", "value": "e39cf166b6108553e9a4ec390c2dede7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763245147, "uuid": "852f1341-20f3-41d5-858d-950d2b32900f", "comment": "Malware payload", "value": "770c92f9ed1a9f15ff36211de73cd3df44693dccfb6c20fb45ee5c7e425279db", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763245147, "uuid": "5390532a-ac21-491d-a2dd-97e0bd1e933e", "comment": "Malware payload", "value": "5d2dd40d9917463be49ff488231e3eb3ad695262", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763245147, "uuid": "18411218-69b3-4d3b-8b4c-d755084f9225", "comment": "Malware payload", "value": "0ecf77b0275057d4ca758ba3898c80c184382ed820b87523957e613691a8ba3302df98e33c0e65efc254f3fd5454fadc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763245147, "uuid": "a10df693-ef4e-4a19-a78d-05ff3bb4f3ad", "value": "T161163386F8421F42F7174935D7926791178ACFA09AC3C096F8ED7269C474BC6202BFA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763245147, "uuid": "4dd9c50b-7ca0-45f3-b08d-68f3c723e526", "value": "49152:lUSxGnhnHUxNApGpJRwnVPh/TetgO6RsCA6/gs3FRqd4ryoLQrvQP71TuKfm84Qd:lUL5HvSRwVJagut6/V1RM4r9Q051+8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763245147, "uuid": "058e539f-4536-4243-8ea3-c5bea6b5a7db", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763245147, "uuid": "dd0c3c04-11d2-450b-8c0a-f80279b2fc28", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763245147, "uuid": "27156ef7-acb8-4963-8988-ce1401eabd0b", "value": "SecuriteInfo.com.Trojan-Spy.MSI.Agent.12783.31328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb47437-c264-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763239888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239888, "uuid": "5db235b4-baee-4d5c-941c-c74d7ed09f3e", "comment": "Malware payload", "value": "76d8a17fd94d4f4ba796553750040442", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239888, "uuid": "99aa6f8e-8a85-49c8-a4df-74f7e424eec5", "comment": "Malware payload", "value": "774aa045f5a70f77419a50ff5835718a8e96ed290eafb215fc56b876315eca4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239888, "uuid": "39abe708-6f9c-4bef-9e9c-ef54f6c72d4b", "comment": "Malware payload", "value": "3a893f3e18f137058de4c8cd336c11cc1810f552", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239888, "uuid": "49f0fe96-8c83-4864-884a-617b9a06d348", "comment": "Malware payload", "value": "79ce18f41f745dddc96ecf4151feb38434d2fc419f5f91f224c65c8b17569028816389a643ab1171f539b710319dc813", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239888, "uuid": "d23573e6-52d3-4876-8b8b-dbc6c7386c57", "value": "T17621FBCF51D1C0212944C805B5EF89283A1DDF962FC3D69DE8592B1E64A8E15FC29F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239888, "uuid": "40dc9458-9611-4b28-8d19-da7ce38e1441", "value": "24:Ho1oWBfEENuC73EENuRUEENu7ZZyEENuMEENu89G:Ho1oGfE0uSE0uuE0u7ZZyE0uME0ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239888, "uuid": "4a7281d2-f0ff-40bf-90a4-15a2f8bf768a", "value": 1165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239888, "uuid": "4131794e-dea5-4505-8031-1935451b8bca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239888, "uuid": "12e0ba36-16be-4d78-9e96-29582824d149", "value": "tvt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db8c696-c254-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763232805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232805, "uuid": "72444289-3e99-432d-8514-9a7b850eed66", "comment": "Malware payload (Mirai)", "value": "76614c810e82008f17f6db6300a08edd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232805, "uuid": "a7e1b9f5-6c2e-4ed2-ad51-1bc4a98295f9", "comment": "Malware payload (Mirai)", "value": "77db2c7519e62e66f3a6cf8d7869a5fe86f3bfb069748f2b80e7f6c20e9172a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232805, "uuid": "bc5b34e7-4515-4420-9a92-b7235e88895f", "comment": "Malware payload (Mirai)", "value": "2ca4d8b4c5f6feaf5f5903491cfe8f6c03895e2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763232805, "uuid": "d2202631-4d54-4872-9ecb-bbefae87052f", "comment": "Malware payload (Mirai)", "value": "f1f9aed11fffc2aec8d2406411e2672095cbd20de31b5d35ee2553c4aef0a3a339818de2c99091623767a89ba0a098a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232805, "uuid": "7fb2da46-70f7-45e2-bb13-71092cd36dc4", "value": "T179E3F709BF610FF7E89FCC3705E91B0528CD556732A93B36B634D918B64B24B26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232805, "uuid": "ee8e82c5-f85c-4e30-b726-c0ee33c4e2b3", "value": "3072:q/V6WWosd4Bi3u7KGzJtcMaeeGeVlJSncDMoyJi6ts1uYa0:q/IWWosd4Bi3u7KGzJtcMae10lJicDMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763232805, "uuid": "104d1b25-eb7d-4b11-a554-b4f670b1a0ff", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763232805, "uuid": "3f219cca-4842-4633-8f9f-22bbfc756815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763232805, "uuid": "22516f2b-12e3-45b3-b3df-bf990ebf8f58", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cddb7d-c1ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763166508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166508, "uuid": "798bf3b5-a887-4f13-9760-0891890717ee", "comment": "Malware payload (Mirai)", "value": "be399c3f934f0db965995cf11153710c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166508, "uuid": "71f350db-e4e3-406b-ab2c-c97bbedb97b6", "comment": "Malware payload (Mirai)", "value": "78097b42636b1d2a21725c65ac410642767c8f5d54842e3f06b5b01d965fa7df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166508, "uuid": "302af2f8-ebe5-4671-ba39-6669f1a8f31c", "comment": "Malware payload (Mirai)", "value": "c9fb6827a0c6c650c0161aceb61ff0f6135c5c09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166508, "uuid": "ec04b633-b800-4cff-9f33-6663e51928e3", "comment": "Malware payload (Mirai)", "value": "8557a4865857c8ed997b76004f73f8eb9a56da2919aa66753d7d8103cd1ce49cfbd42669e6db5bd20a50f6e9ba63cbb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166508, "uuid": "7253549e-f2d5-44d8-9bac-714e3a33ec87", "value": "T196B33AC4F98F81F6C04788301067F63FDA31D9A94171DA6DEFAA9F36DA376429112788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166508, "uuid": "04520b21-80ff-473b-9b21-f6ec55023dfb", "value": "3072:f+I4E9YPg2qhlyXYQFDrgxq8YkMCOF6w8QWf:ywAHqoYQFvyRHQWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763166508, "uuid": "5cff97cb-396d-4b90-b8d7-2dfc5abf9548", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763166508, "uuid": "0d25115a-5c59-4d0b-abdc-51c4693c9bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166508, "uuid": "bfefc2b7-dd36-4bf1-89d1-111b15584cc7", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4488c5d4-c238-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763220737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220737, "uuid": "1eeaf4b9-f776-473a-94f1-41c46ceddd1e", "comment": "Malware payload", "value": "ede72565fcbed6b2fbeb9dda1d67abd0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "trojan.msilheracles/msil\u0431", "colour": "#ADF941", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220737, "uuid": "53edfa41-fdb9-4ff1-8eab-6a53bafc8a4f", "comment": "Malware payload", "value": "7a28a02a5ce1d3e19ab2d35feb2b585f096e56175fb2980e29947079d3467a2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "trojan.msilheracles/msil\u0431", "colour": "#ADF941", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220737, "uuid": "b969079b-e74b-48f0-809a-f40095fc1d19", "comment": "Malware payload", "value": "5bd470d2e020a8e8d9cd8247a73aea4763b17762", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "trojan.msilheracles/msil\u0431", "colour": "#ADF941", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220737, "uuid": "e3f35e8a-27ef-4e1e-b708-577e2eb3a88a", "comment": "Malware payload", "value": "5de876822af712aec3ebbf65d0e28cd940cf8d10af494c40dac8dda80d49eae5cba3f85ddfc80706c293957ee21056a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "trojan.msilheracles/msil\u0431", "colour": "#ADF941", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220737, "uuid": "7846307a-eb02-4f05-9d59-aafecf9a4ffe", "value": "T198748CB3F18B3378C6095B7BC49D9E30457309C7C59A4E8F22A513EB7A437638948AB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220737, "uuid": "68824c96-c387-485d-a1c3-fc57dece2a95", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220737, "uuid": "c0ecea54-bb4b-4956-8af3-fc307cbfcb23", "value": "6144:VNS7iHvyDhGWb6xtWSV4lPOw497tgO/NmoqW:e7iHvytGw6/Wtg/g8qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220737, "uuid": "76c0aafa-1b1c-43d9-ae46-f1acb096867c", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220737, "uuid": "d0119152-cfbf-4bbb-a8d1-d1912bc98940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220737, "uuid": "a04252ac-9084-41bf-a747-1764a4d763eb", "value": "c.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06622e21-c1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763187561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187561, "uuid": "542e1fb8-6e46-4903-b5d1-8eae991ef6da", "comment": "Malware payload (Mirai)", "value": "cbcf9fc86383dea49790abaae2803d16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187561, "uuid": "cefcd706-389b-415d-b9fc-6ee4e09c6563", "comment": "Malware payload (Mirai)", "value": "7a5963641047b91e9d056037df1d88332f52916c7f9bff95931bc3b743ffd3de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187561, "uuid": "b7d7e5a7-8374-431d-89a3-c3f25e8a54f4", "comment": "Malware payload (Mirai)", "value": "4e695bdacf908626fb11919edec5695107e37810", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187561, "uuid": "9ef50f7d-cac8-47d5-a719-757b8c993c07", "comment": "Malware payload (Mirai)", "value": "92a041774abe82be1f316f87f6d1d854b69c1139ab1d3a2df722c2657e900a7b84b9942fc35de72775118d81f5eb29e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187561, "uuid": "e7fca207-d603-4144-bdda-e171148fcbf2", "value": "T1CBD2F17D14F3E862C3A25837AE7C9699C2420174C8F9DB320C785A39A164D057D7BBDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187561, "uuid": "e207e557-324d-4a8a-94a7-cfd08b667d05", "value": "768:w8KdDGlQ9Z9dKtfVYwrzV1HwYHVhInvuGINs3Uoza3:wBfZ9GfOwvhInvuGXzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763187561, "uuid": "3a08aa9c-20ae-483c-b590-12430298d5ce", "value": 29080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763187561, "uuid": "8777d6a0-fcf2-4879-814c-8f2de3b781a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187561, "uuid": "49a3d5cb-e0d7-447a-bb5e-42f15980a300", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b110bb-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230637, "uuid": "6ac988d8-5cb5-4104-ad8e-2dfe65f5bcb8", "comment": "Malware payload", "value": "7b79ccbe0c01e6db12613d6bfbd65b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230637, "uuid": "07f03492-399c-4bca-bee3-0236e231b563", "comment": "Malware payload", "value": "7d27f4c83befe4d00c3814274c06eb7d753e8ff0493614ab297473200773f484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230637, "uuid": "481e018f-eb4e-459c-859c-ade590be65f4", "comment": "Malware payload", "value": "5b263a2949c4779e113c51f683f89d57295e7424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230637, "uuid": "0761786f-c786-4e55-a810-4821f43cae36", "comment": "Malware payload", "value": "ca1a7d4f400a0d629f4f4d71c642caa078b61be1fcbd76ec60a742d6c5dd0ee1b3d8ac4779c0a6943f2ea8c4a29c505a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230637, "uuid": "f02e382b-f93a-472e-9432-507da127f1e1", "value": "T174532B86B8819A13C5D862BBFA5E41CC372153F8D2DF3247DD216F157B8A82B0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230637, "uuid": "23360f18-02c8-42f8-adcf-f556cd190805", "value": "1536:54G4CGHBQzZTbrgYBhkAlzzeoopyr+MjG7uybVR9:WG4CeYreoopyrw7uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230637, "uuid": "a58a338f-0c09-4660-a41f-8507b11a6ead", "value": 63116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230637, "uuid": "2e9333d5-2311-49f6-8585-e81665a13a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230637, "uuid": "0272fafc-e39f-4b58-9dd7-9c3328cee790", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f2729b-c1b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763165544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763165544, "uuid": "91efacff-af34-4472-b164-68cb6776ce18", "comment": "Malware payload (Mirai)", "value": "cb996f8989b77cd388b213040fa19ac3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763165544, "uuid": "d2bce3e0-30cb-424a-aaa6-2ff7e1dd5820", "comment": "Malware payload (Mirai)", "value": "7d4c1465dfd45812403c2716f4ce4165464c95fb2e9d45baba9ff70df6ebc3ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763165544, "uuid": "406b35cc-18fe-414b-9464-da53264a5723", "comment": "Malware payload (Mirai)", "value": "216a5bafa98e8bd59c3c2399a0a661b5b43dcf30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763165544, "uuid": "0a7c8bba-8bfd-4207-b2cc-6c3c9cb1ea9a", "comment": "Malware payload (Mirai)", "value": "565c62588abec18bb663acd1c9f66a6e5c6f1b84f3aeb4896e103f4529f49fbb236d5d30944760a9a970a0dad7775df9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763165544, "uuid": "721513d7-8be3-4ba0-a818-f33c1a703d0d", "value": "T161D3D50E7E218F7DFBD9823447B79E26A65833C627E1D581D1ACD6011E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763165544, "uuid": "3475eacb-3f24-4364-806c-db8464c16949", "value": "3072:hjhvzgvuZ9N75byP7LO0xkpTa3Z+aCQuXsHV3:N9gvuZ9N9uP7LO0xkQpMXsHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763165544, "uuid": "983f51b9-5f60-45d0-b8a4-be47deda6d1d", "value": 136748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763165544, "uuid": "9c329332-6885-4c31-a099-ed45dcf2c875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763165544, "uuid": "f62c4554-8847-4e0f-a2a3-4769b9d8e20b", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bfb2aa-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240625, "uuid": "ca6b29bd-b0a8-4911-ab63-735e86cb10f5", "comment": "Malware payload (Mirai)", "value": "7cf8e629c21b4965229fd3fc1ae97f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240625, "uuid": "5d0a983e-7cc7-4a41-8c11-ec20f095e9d1", "comment": "Malware payload (Mirai)", "value": "7ef73f0492ccec6d9069d052763baf08bf5b9c22c7b41246f5c786d22fd1dfa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240625, "uuid": "b6e148c5-fabf-41a7-95c6-be7b82ae9435", "comment": "Malware payload (Mirai)", "value": "a973d5cf5db8b01e1bf1d40f626e53b38fe7b5c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240625, "uuid": "ac7a97d5-0665-4fbc-a715-2086392516cc", "comment": "Malware payload (Mirai)", "value": "8f257956b0c53ab468d4bbc546ec99ee15c5eb4e8c292201d0f82b79dd59c82263548e901b7aae71e836466e4291a22c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240625, "uuid": "7f75eb79-1873-46d9-b3a8-6e20025dae36", "value": "T112C2D0B16D1628B3DB7419FACC549ED66D8A6FB8E035B0B74748A314E4E0E40A7E50C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240625, "uuid": "b22207f0-73c0-43a7-92c9-cc22a720f8bc", "value": "768:z470n4hSNLRSoPmaSRDR6LO1YBtjPrl0X9q3UELLk:cVhELRS6mfWLftzKmLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240625, "uuid": "2617491c-9c10-4149-b9e9-77cea706414c", "value": 27328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240625, "uuid": "09eddc6e-5db0-47a5-b036-ddcc076d56ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240625, "uuid": "27a29fcd-b58f-438f-8a22-9d53e5643266", "value": "brichs.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1035e0c-c23c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763222744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763222744, "uuid": "d8c21ca8-b7f5-434a-b1cd-5b12d4036436", "comment": "Malware payload", "value": "121b7562c0b48abdc8395e1a4621385e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Win64.Malware.Heuristic", "colour": "#A9959E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763222744, "uuid": "ff517384-7295-467c-87cf-463086b25728", "comment": "Malware payload", "value": "7f98dc14437c2ce9d014457eb436e8cf15f2fdee7ad531f6d0e8def692a559a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Win64.Malware.Heuristic", "colour": "#A9959E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763222744, "uuid": "fc55d110-e356-4067-bbfa-fb6d79af9995", "comment": "Malware payload", "value": "af6b807f992af61abb25ff2a152f9821ac5b2643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Win64.Malware.Heuristic", "colour": "#A9959E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763222744, "uuid": "8df49f08-b919-4fb4-aed5-0bc6b8b14f96", "comment": "Malware payload", "value": "cdbd3eab3262bcc40583f8ce6b63b7c54701a4df82f2c93695b058515c79c09f44abe7b2ea379f227c1d9f8e4cc9bcde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Win64.Malware.Heuristic", "colour": "#A9959E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763222744, "uuid": "1ecd3e2e-7a14-4281-98ff-4768fb80c53d", "value": "T1FE97E00006B929B6D073877089FECD7199767C9A751CC09F1096FE9F3D72B029E2963A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763222744, "uuid": "ebb93ac4-dc42-47dd-bbe3-513f78daad82", "value": "f7da0edb3fcb53de3c3d02a0036f651a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763222744, "uuid": "8f671ef8-e3d1-4d5d-9826-c9fbd9cf3dea", "value": "786432:D5RZJpuJOUgpC4ImWjEiO99uuhOzA6z9Zd:PDpuJNUfNWWlOzpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763222744, "uuid": "0640e0d5-0bc1-4209-b360-e532c5fd4ef5", "value": 40265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763222744, "uuid": "08c576ca-58af-482b-88c9-940686a08985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763222744, "uuid": "dce546ed-6140-40d8-9867-3e44a7900393", "value": "cacservices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afcd59a-c252-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763231834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231834, "uuid": "c586690e-707c-472d-91a8-c844f642a141", "comment": "Malware payload (Mirai)", "value": "16cbc511578a06116ad0949b12b8111d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231834, "uuid": "a6c0fc96-4b55-41a2-a7a2-c6c403deb733", "comment": "Malware payload (Mirai)", "value": "81f81e4ad3508cd865b9245b2c856241111d01b7fa839f20e202815589a0f043", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231834, "uuid": "98d44b19-70ee-4f9b-8e21-2699b7a7b9b0", "comment": "Malware payload (Mirai)", "value": "8674e4e9c016e2de9ed52e0ffdb363732f2917d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231834, "uuid": "562e67ad-b875-48fd-9e97-a701f8116192", "comment": "Malware payload (Mirai)", "value": "a034c9218dfee960532f4677ed0bc9c6fd64414a6d72771b6d9858fef1064b6552532a527ee0629b8e817278adc88b8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231834, "uuid": "98f90af1-b3a5-4183-8bde-08d32d350708", "value": "T17E13F15DF8816EE0FEF48DB46CE4809DF3A02E1417A70D772840AF5A249FC16A359ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231834, "uuid": "4ab5b5d1-e508-41ed-be2b-a3287ca5c73e", "value": "768:S3Lz1SGVh33PjBqXLFAtxhKlyIwOaWitmVzUTE/L498sODe4uVcqgw09k7:S3lS6bB2At7KlyI7aWiUgULcOK4u+qgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231834, "uuid": "cd1a4747-1584-4a70-a98a-67a7e34887ae", "value": 45236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231834, "uuid": "3785b4d3-8766-43a5-861e-7852af2c92a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231834, "uuid": "757c2e62-dcb4-4b00-a92a-c9cc91d16176", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df274d3f-c1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763166450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166450, "uuid": "6aa4b2b9-11db-4f68-bcfd-4732ffaadeb2", "comment": "Malware payload (Mirai)", "value": "2460d3693a87fd32e78d926137b9c05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166450, "uuid": "d250e326-2988-4a85-a188-2814292a5d5a", "comment": "Malware payload (Mirai)", "value": "835608c55ae464c75cd2de290f911af969613d5221d97b558545836450ccfa5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166450, "uuid": "978a7cf0-4608-4fc6-baca-25e2c128c25f", "comment": "Malware payload (Mirai)", "value": "f50d7970a0331cc03da366bb5d799faae519cb73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166450, "uuid": "1ff02b09-6cc2-47a9-b673-150e80110a0c", "comment": "Malware payload (Mirai)", "value": "ca537af13c7af7e54976b4367dd1e2f25b1a846b54a3baf50824989b0eca1650137f3052ccd59baf68b7a2376d6edda1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166450, "uuid": "163c829a-a381-4c4a-9513-6e0bdd7050f3", "value": "T19F144B46EA414A23C0D717B9B6AF42463333A7A4D3DB330699286FF43F8675E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166450, "uuid": "c3944a8f-3d7b-4a9c-945c-3723ec4ce38a", "value": "3072:cx0SqHzpxRjG+IasUjr/S5nQcJkSsCZEN0U6H3uWxDM/9a61s:cxzqHdjfIapjr/S5QcJeCKN96H3uuDMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763166450, "uuid": "dbbee9f4-5e80-433b-980b-200b6c7f888d", "value": 196025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763166450, "uuid": "03f9fdad-c4bf-4673-b7a8-f08dae627f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166450, "uuid": "b9a8fa33-f1ef-4d57-bc0e-9a134c3365ff", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bfe5cc-c1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763192050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192050, "uuid": "a3b827c8-9088-4fa6-b083-c7d520e85466", "comment": "Malware payload (Mirai)", "value": "51b8e8a516f3a227538908815d4f23b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192050, "uuid": "826aa599-f799-49c6-b187-f5396f04d83c", "comment": "Malware payload (Mirai)", "value": "835ff10960742506e470e71e70baf44ba9012ecbaab58849d16b444ee3e2d927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192050, "uuid": "c8acb740-37be-46a6-a2bc-f3506a60ff3a", "comment": "Malware payload (Mirai)", "value": "e8612872b519375ac1d301fffb3f98f34e5bd92e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192050, "uuid": "eaf7a187-d840-4509-950c-6d6fb5689a9c", "comment": "Malware payload (Mirai)", "value": "993fb2b3c280ee6547b1f4f1e96dadf0a52d3ee92a041e4d1c0fae8e377d32b2ee6796dfaf799e761957fa886c2bf00b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192050, "uuid": "962ad1fc-464a-46a4-82cc-66e6b35d4455", "value": "T107534A9EA401CD3CFD0BBB7ACC1A4B04F521771556920F27A7AAFD935D720A88D1BD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192050, "uuid": "c41e0537-f469-46ca-a533-7cb5fd28e6fe", "value": "1536:BIRQmOEI+JcS0H3fu1PPPPPVKCaSBY/91DCviMH8q0laTP+:BkQmOI30H0PPPPPVKx6YrCqMUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763192050, "uuid": "b5fec5f8-78d6-4da8-957a-47543c1f2cc2", "value": 61656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763192050, "uuid": "6f5acb6b-28ae-4d5c-802f-241deada96b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192050, "uuid": "4b957b3d-35a4-479a-99dc-b7b2c9dba104", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19efd245-c228-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763213793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213793, "uuid": "1862c146-b5d5-4f87-a8ea-06c9d706ebe6", "comment": "Malware payload", "value": "4c4c373b1387194b5ceed4143f60d25d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213793, "uuid": "7fbe54d6-5431-468b-8bb5-d3a1658add5c", "comment": "Malware payload", "value": "83a60001fdf8e27f91ce9d9ad960f602b7c019fb6f043cafc604c370ef17cb12", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213793, "uuid": "7c409edb-6cf3-43d5-a27a-72ebe010db05", "comment": "Malware payload", "value": "f933c371608ef3931095cd0fb4b9052dbec84439", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213793, "uuid": "08b6acf5-b5a1-43f6-8492-a7fecd271831", "comment": "Malware payload", "value": "acec94ec4831e5cb1bff41d9b00ea3243375d70973e6630cee2930820ce2231eac19f80afd8bdfef02475f0715c634eb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213793, "uuid": "9e1fec11-c6dd-46c2-894c-75295cd94379", "value": "T1B5D523DAE3A057FEC8E47976266B503447F09E500602DB4ED369B1BD0D326BCE76206E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213793, "uuid": "b5773bcf-ae14-41ed-8b99-1d9e20f1f587", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213793, "uuid": "82bbad4a-6d7e-4131-be2a-0d066cf06493", "value": "49152:WgeboiaA1yMdOX5TrrsrSuZFDefC4tjybpxmDdu8qaSHa9Fc7y:Wzboiz1jOQdZFyC7bDE1IX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763213793, "uuid": "c1dd7b65-8a37-46d8-87ca-38cfd2987b17", "value": 2840144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763213793, "uuid": "be07199b-2dd6-4a43-ac05-bcf04f684107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213793, "uuid": "98a0e2c9-d7f6-42bb-af08-78142f4f6537", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654249d2-c1bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763167105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167105, "uuid": "69565e1c-a0c6-4b83-97d7-74a2b49eb9cb", "comment": "Malware payload (Mirai)", "value": "7aff31997a1d5c33a3108de409ee34c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167105, "uuid": "97618a2e-9231-494d-9d48-fa9eee00143c", "comment": "Malware payload (Mirai)", "value": "83b23787e574d9faf50b6ae079246289a828474bba2605f90b8b889f6e1f50d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167105, "uuid": "c24e1f79-22fd-444f-9e07-c6d098e90b30", "comment": "Malware payload (Mirai)", "value": "4a17b56253b1adcaa63e866930586b43deb7fee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167105, "uuid": "303edca0-ab5b-4954-bb2a-73ccc8502459", "comment": "Malware payload (Mirai)", "value": "0b6f63a4965409525b417dc4543be6e2a4846cc27ee53093dfff39130b8e5bbf3846cae6a057de69bf2015d4cbf79213", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167105, "uuid": "de7a4a88-6f61-4909-9822-0f1c6a85f506", "value": "T17EB32996F8C14A62E5D702BEFA2D118E33131BE8E3DE72229E245F2133C656B0D77945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167105, "uuid": "afc7fd71-d59c-43ee-bf2a-a169cb36a9cd", "value": "1536:HHnr4/LpCcNt5q/nELBGVIh9fPd4u7vlZ6sL7D+7Qao7bV+XQDVRibPU3LyB7QvO:rexBXR76Ef+7QaocPU3LyBMvZ9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763167105, "uuid": "d5c24647-61d9-4eb6-8e00-98a49a3d11cf", "value": 116924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763167105, "uuid": "1370d0e5-e925-4ebb-9954-98e535bb41d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167105, "uuid": "5d1157ae-3c57-47ab-826b-05855dd7d837", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a2c11f-c237-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763220515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220515, "uuid": "69a92bdc-aca0-4cf2-b85a-a9bb2db19457", "comment": "Malware payload (Stealc)", "value": "9cf3c30f69c043f6ce0549b66e18a5ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220515, "uuid": "4665fcc2-ead9-4aa9-97f8-d5f2679cf7ef", "comment": "Malware payload (Stealc)", "value": "84314dde0600731404923dab3d5db4c36e991521c5cd55b6bd3a1a5cfe3e2b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220515, "uuid": "ee4fba66-674d-426d-bef7-f5c951d1b012", "comment": "Malware payload (Stealc)", "value": "1170ed1be3fdaa8c84bc6093a398503b32b2a20a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220515, "uuid": "6e801117-d42a-46ac-8a94-0c7628d6f204", "comment": "Malware payload (Stealc)", "value": "52eb61751e08ca215c972f19fdea6a471e3761c790cc58d046c56a9ecfac99e0d94996722559a5bb79bc4795edf7a13f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220515, "uuid": "076d6899-090a-4e93-9bac-37b1688ed221", "value": "T1AFF48D1FF7E501F8C4BB8178C9625956E77A74561330A68F03E019A63F2B650AF7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220515, "uuid": "4a0f4913-d6cc-4c42-b952-1931d48c8b08", "value": "112f19f28f55f461c3d7ad7d3898dd7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220515, "uuid": "2abbe9d9-b84c-4d44-9ba0-93365b2d31fa", "value": "12288:NwVVzJIAwvrbhu/qhV8rNqDVqoPj1ad0+CUzdv3YZtF15kjHx:N2obD1u/kVyyVqoPj1U0gp3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220515, "uuid": "992d444c-9d7a-4d3c-9dce-29ff6833f4f9", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220515, "uuid": "eded4222-885e-4fa1-8e36-235e08927d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220515, "uuid": "92aae684-d6f0-4f1c-b898-0521dc58f85c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7e1362-c201-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763197369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197369, "uuid": "95315f5b-6d17-42aa-b218-0d97c827e2ba", "comment": "Malware payload (Vidar)", "value": "c450dfa416e535a0ecf00aafe4b0e8d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197369, "uuid": "5e311ccd-9db5-4a9b-9060-91f9be095faa", "comment": "Malware payload (Vidar)", "value": "84672d86ca44479fd388f451cd97002eb1e7ea94aafd62786d52eca5a2ff1fce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197369, "uuid": "07ee8a46-1a6e-4e82-8d17-c5be459eac17", "comment": "Malware payload (Vidar)", "value": "ea0a55e8d1c594a7897a427a1acce2756961a06a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197369, "uuid": "1a855005-ba96-492b-b167-5f35bea9f42d", "comment": "Malware payload (Vidar)", "value": "88ddfd73e5264d414850193291afa33d8121e682ebe99283658d1be36cae22947066b054d559b36d77931a37c440f176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197369, "uuid": "5dc55a05-80b3-4c16-9208-cd3dab5df40b", "value": "T157F56C476C908D7EF466E23488F251726A64BD0E07726BC33F117BB92E72BC40972769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197369, "uuid": "585f7900-5bd3-44c5-9440-f3569f9276bc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197369, "uuid": "e7bf88c5-4b61-4a48-ae18-3b1ec6e30032", "value": "49152:Sb0k7mcJA4lOcscNXjFnTu/8TDTk1UV8pCzwMIxEknqR4NvFp0O:SpmohItv0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763197369, "uuid": "5d84df61-3dc6-408c-955d-da5ec777737f", "value": 3653128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763197369, "uuid": "dc836c37-be75-4ad1-b30a-29123bea27e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197369, "uuid": "caa694d8-6f12-4e47-8617-551f4ab74b71", "value": "BootstrapperAppxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4365865a-c208-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763200119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200119, "uuid": "aedc9a05-9ff5-43bf-ac87-8ad6ff9ea499", "comment": "Malware payload (Stealc)", "value": "d42644a7cd4dc4438193ed2f104ae336", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200119, "uuid": "b8e394a8-1741-4e42-837b-c4efecde9e3e", "comment": "Malware payload (Stealc)", "value": "8543ee115affdc612074f497d678b0d7f5ab1d745b40c1a02514ce4e12333a49", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200119, "uuid": "09f62c37-ac13-44fe-a8b4-c76e46169c9b", "comment": "Malware payload (Stealc)", "value": "99e50bd6a221a2675d5fba3d7063fe671fd171a4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200119, "uuid": "3026669d-12f4-4d78-9958-0544da44a3b5", "comment": "Malware payload (Stealc)", "value": "39c4dcbfce93bb51337d133cfdb28c983f1ef5373458fb9fa791f918a710111ed5753e5f1cb8a0c2319d8752831981f7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200119, "uuid": "abf8268b-bc56-46c9-91eb-9b6ddd566a71", "value": "T17BE5230F6BF1622AC9C64B37D4134212E777DE70893E5A3F21113A3D5B7AAC89B59C12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200119, "uuid": "a655678a-d957-4528-8b3a-e7888ba37edc", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200119, "uuid": "1ac336a8-2c14-4375-b165-811b76c88bda", "value": "49152:wf95H/VeMUEe6GZiSIapRMvvWs6r6+ceHkCYwv/xugo1VB6bR1H6Weo4rxLARw46:qcZEe/3bsv+s6r6hUkTwv/ElrB6912o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200119, "uuid": "2879eea2-e009-4047-9846-1177bfebb1a8", "value": 3090528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200119, "uuid": "9c69fb38-6a7a-4619-88ff-76a9ee5848ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200119, "uuid": "cf61c4c0-2980-485f-80df-e7e0f0bea160", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10d980e-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241535, "uuid": "bb8900d5-487b-4704-8ab3-6b70f970dc63", "comment": "Malware payload (Mirai)", "value": "e0998adc135f12fd4c2ff56658a0073a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241535, "uuid": "be702aab-e62b-427c-983b-1e27cee98cb0", "comment": "Malware payload (Mirai)", "value": "856c35fa5043b8ee8e231651eb9a61aeae031be335679e4f6f37af7974d8f276", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241535, "uuid": "548f803b-1c83-460d-9eca-0ac7c006866e", "comment": "Malware payload (Mirai)", "value": "d89e59b4a33e2697b222200f597d297d0ec9c29c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241535, "uuid": "9672b3df-0ec0-449d-8459-a3a51d0390ef", "comment": "Malware payload (Mirai)", "value": "e1222091b8f8faeb6c0f340cf5186476679e0615f281d396aef69333dab884b12a1d68fb99b0d7ebc071126ac1aa0f95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241535, "uuid": "643ce762-8a95-4c96-9860-89d681f1b942", "value": "T107634B9AF802DD7DF81BD77A4453090AB630F3D502831B3B639BB9A7BC721991D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241535, "uuid": "beb05966-b703-44c7-95b3-5edfb84eb284", "value": "1536:UEgwF6rJcUGNDDYb/7O8V5jc1vxZ+45dJm7+dbsWhjQ5a:UEgg6r+PET77c1pZl5/mWd4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241535, "uuid": "cdd01912-ee14-4f3a-a55f-ea95fbf1e818", "value": 69628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241535, "uuid": "be309ce1-a8bf-43ce-8c5e-b8f4d6d7cfbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241535, "uuid": "ff99dca9-5721-412c-b4e1-005493725af7", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556ea025-c1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763185546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185546, "uuid": "23dd2af3-527c-4aa9-a8d7-30f45bf26c5e", "comment": "Malware payload (Mirai)", "value": "9422b0b1050cce83ffebb04b4a378143", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185546, "uuid": "f019956a-caca-4842-ac64-ebfdc9b49ce7", "comment": "Malware payload (Mirai)", "value": "85f8b2744e8e2b0bbeefa4983ad52c949b0b8e58aedea900ff73ea68e0c5eb75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185546, "uuid": "39d57271-480f-40a8-b5b3-a4c8d9960158", "comment": "Malware payload (Mirai)", "value": "9110e0fb0d80f6f5e2a568d56ef98fa294ec8f60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185546, "uuid": "d204f364-4959-44c5-9d86-f865827e4ecf", "comment": "Malware payload (Mirai)", "value": "60e71e1369fec2b5ca1960bf47d709be7a8b34567edb0f4fd8c3f3417e68520e46af7d677d058cf7b3f49bb89807fcc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185546, "uuid": "31403685-0ded-4e1e-9393-fc8d11917a9b", "value": "T138D3E81E6E218F7CFBD9823447B39E26A65833D637E1C585D1ACD6012E6024F281FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185546, "uuid": "c7b0930c-eee2-4253-afe6-0b4697b9e733", "value": "3072:n7874ONzGE4moI3EknTehd96xMv+vn2w67g//I:i4ONzGEFoI3EknTeNcMv+v7Og//I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763185546, "uuid": "3d52cf1e-9080-4004-bdaf-ce873a3ee390", "value": 136472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763185546, "uuid": "8dce97dc-3bff-4943-b21f-a8bcd2334dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185546, "uuid": "ac4915de-dc51-45a3-ad97-f1c663d9a256", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ae18d3-c266-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763240625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240625, "uuid": "f38118e9-e725-45ea-9888-f5145657d3e1", "comment": "Malware payload", "value": "4b1443b91c2a8ac81afb871faa55c044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240625, "uuid": "d2c92c7c-6bd6-49e8-9ecc-d133e4053805", "comment": "Malware payload", "value": "85ffb4d26adb60e1aa5722aeb7495b35cb992aa87e212928e1adcfeb21ba9a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240625, "uuid": "b1494ce8-3e5f-4bb0-ab3c-bc2278532bb2", "comment": "Malware payload", "value": "d8c9c1179959a8e884ba7f1595b67b7e7adebbb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240625, "uuid": "51c145b0-d0b4-495d-9521-2527e3478df8", "comment": "Malware payload", "value": "2ff05f250430c3db959d67788d33327f893b6ec4ddfc851370eacb4a6e97cb6be6063c77b115903e10821c04f0798080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240625, "uuid": "f8275f28-92a8-405d-a065-059101df3392", "value": "T184F75B4267FA04C5F9FB9A3499E65213D673BC066F3085CB324C172A1F736E099B6722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240625, "uuid": "5deabf67-f9c6-46fa-83b8-b72532ca7094", "value": "35686f86a183dc6a9ec694033bf670c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240625, "uuid": "4972282f-2da0-4a97-8d87-1f46c61f8003", "value": "393216:VfNi8x+zds3HSSf401gqNQK5plBRVz3xWE+xQSI8w5SvDazn1d5VRYv4LWoaM8+l:VMdCJmQlR4Vu0C1SpgPVlcmLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240625, "uuid": "0a8acd7e-0f72-46ad-a462-c1e25ba01d17", "value": 72996718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240625, "uuid": "bafdbb2f-8b91-4876-827e-35de4a5faf9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240625, "uuid": "1697bb4c-8152-4aab-a947-3d448ad8019d", "value": "v1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cc565c-c240-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763224467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224467, "uuid": "9bd6bee0-0986-4bd8-b357-28aef9e90cd7", "comment": "Malware payload (Mirai)", "value": "e1d3227d8154b7d29875e8b1a0e87d4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224467, "uuid": "2a6fd1ff-4b4e-462b-ae21-28bc93f03b20", "comment": "Malware payload (Mirai)", "value": "865a75b150a813340a7104d5560a85cd6d67a2356222dcc869996f5a4419517e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224467, "uuid": "02284ad2-fb63-4294-8982-76f451446d9f", "comment": "Malware payload (Mirai)", "value": "a4c6e7c5979bd98e43c7607b5e134f2e69c9b8ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224467, "uuid": "7ec32e2e-ea9c-46c6-bbaa-b7a8793acbd2", "comment": "Malware payload (Mirai)", "value": "d0cadc34f0af9d9df03ed6611db5fe40cbe5df4e06d013897fbdde8546426f7db31aaa1e20561fe7716bd61100e5df85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224467, "uuid": "678573f6-757a-4856-bdce-934c0b54829b", "value": "T170330292C1EA4A4CC45FB73E9AD70ACF2F80D89D627B9DE52EC82457824370D6F088D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224467, "uuid": "4ff436e5-0eda-4d3b-887a-f69e49f2013c", "value": "1536:37tqdqi+lurLsNrWveY901WozLpnouy8HyF:Lf1t5ZYS1Wc5outO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763224467, "uuid": "9f5c5817-a6ac-49fb-8828-a0e07701ab91", "value": 52896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763224467, "uuid": "9b6fc352-6348-4b1e-9efe-08eafae91f2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224467, "uuid": "8a245b3c-834c-4e80-8a69-ab396b85ea3f", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8fad8b-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763230813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230813, "uuid": "6a8597ce-b11b-4ad6-814f-6004c5872d3d", "comment": "Malware payload (Mirai)", "value": "b40667a5ee92541485de9b5964d54048", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230813, "uuid": "66029801-3d77-47ba-a9f1-0f3c966a1c7e", "comment": "Malware payload (Mirai)", "value": "86d1089b91ce9ce616774fee8146704ea26f33188be13aa4aba1efff6c5ec79c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230813, "uuid": "5a8953e8-5717-4a01-a298-e39917e112a2", "comment": "Malware payload (Mirai)", "value": "82228c3eff4eb245f4da7a9893cf60e07924e9cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230813, "uuid": "e285e6c0-3872-4b52-a360-2c98a9321ce4", "comment": "Malware payload (Mirai)", "value": "18a9f0bd2b5f309d363e9bc48528e8c30ab755ca330065cfc11a8cc5d12f6f70a59cf90891c9a8c0120075c1d3565ed4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230813, "uuid": "6a505e2b-4bfc-4fc6-9335-1b6b6069c4ff", "value": "T13C23024C77279E60FDE162B3E950885BBD689BF8A3CCB6B75378865060591C25B3EC03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230813, "uuid": "2d378ef4-36dc-47c9-8c18-0ef2a30129ed", "value": "1536:e5FFcwax5tYZHks+gx65a0eUub/lITFLmJPLGX:eizx5tYZHks+gNfUuJIhLmJPLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230813, "uuid": "108a9ef0-8b00-4680-898f-345cf4f96bad", "value": 50096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230813, "uuid": "948e24da-4ca8-478e-8a46-fb7835f8803c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230813, "uuid": "24d78aad-d75a-40f3-949e-bf29e92ad87f", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ce5cc0-c1d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763177762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763177762, "uuid": "a1374a91-d9b6-42e3-9358-6c5e8784d3bc", "comment": "Malware payload (Mirai)", "value": "319dc2ba4a8f2c0e416381e30b4fae23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763177762, "uuid": "6cc4757c-114b-44aa-b729-659e555c46a9", "comment": "Malware payload (Mirai)", "value": "86ec22894200341ee340f73eed6fbf0752178fc44480b5b589a3ecd446e42b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763177762, "uuid": "029f8da1-c146-469c-b023-ce22bd6a2165", "comment": "Malware payload (Mirai)", "value": "9139c5d806e76fd0eaa7ab63d28136049e7b8720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763177762, "uuid": "0abdc0a2-64c3-42c4-9f5c-15b012934ce8", "comment": "Malware payload (Mirai)", "value": "ca53e49a7b70a400a11908825cae8c508061db910a8d0d365e7833aaa7500046b218a03c56efdc389e7e511f3ea1dca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763177762, "uuid": "d5a8b3d9-44b0-4182-8972-488efb833c58", "value": "T11BD3B021E4006DD1EC2129F578BA96B80350EE700BDE5582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763177762, "uuid": "0d2e8a39-b877-474d-8139-bd38ca92bae6", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/x8:PiySSGp+PMmT7zMpl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763177762, "uuid": "2d77138d-8c9a-41ac-9047-f95da6821572", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763177762, "uuid": "5073bbb0-ae0d-4877-a799-aabb05c90c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763177762, "uuid": "4c0b3792-cbeb-4bdc-8394-607b860fcaaa", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25a8c42-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240758, "uuid": "d176fdd5-9644-4f6f-ae98-03caae6892ff", "comment": "Malware payload (Mirai)", "value": "cd74e34975c0520b9f2faf5fcf897d0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240758, "uuid": "e076c5b1-c31e-4acf-81a9-5d2c4cc2d196", "comment": "Malware payload (Mirai)", "value": "8859cc86cc00c41cf2a10e390484ae42a7d96b89f8eeb8137521aff5b6f4ae2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240758, "uuid": "7127a94e-35d8-49d4-b533-6c151590ba64", "comment": "Malware payload (Mirai)", "value": "48c69bf999c027916906892660bad343c31ca92b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240758, "uuid": "90b24b30-9253-4721-a1c1-c6cea6b7904e", "comment": "Malware payload (Mirai)", "value": "8a792930e4b8d7447a2f483df14ba1911e9618545c277e69c18fceadf879545d835eb75de464ebaa9e0881e433a10546", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240758, "uuid": "4f38e1f4-445d-42d6-b82a-a598c97b0e08", "value": "T1FF431881B8819A13C5D4137AF5AE55CD3B2133E8E2CB3217DE225F617AC682F0C6BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240758, "uuid": "330f3b81-6cd8-4a63-ba1f-8c22c8ab2716", "value": "768:HuJEWve/xjLITDIB7qZxHERZQ7+p9R+eYgc1QC4tjJu/kigVC8mUDEC0qIGN9T3u:iEWVDIcxHEXx9RREWjJzi0p//mkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240758, "uuid": "21427bfc-d8fa-473d-8e37-52d49b37518b", "value": 56368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240758, "uuid": "b0c49edc-fafc-42a1-a286-cc81349c0689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240758, "uuid": "be33162a-cd22-44fa-8b02-7b32648d8583", "value": "brichs.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7f796b-c225-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763212752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212752, "uuid": "0f0ed1c6-337e-409e-9d89-1f3e29aebeae", "comment": "Malware payload (Mirai)", "value": "3dec00eff4f6b7725debd130fb88ee54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212752, "uuid": "a699c4d3-d0ad-44a9-baf7-d7ee06db8da4", "comment": "Malware payload (Mirai)", "value": "894c71e20424bcf62fb514d210dd1d54d97ae20c34f8a29dc4ed0f7c68b68188", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212752, "uuid": "e0baf1e9-78a4-46ee-acb0-1852b25e8d37", "comment": "Malware payload (Mirai)", "value": "9eb84946a67e983da8d0e8d51cdcb4b39b357eef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763212752, "uuid": "f5b19703-6de6-4b34-a858-3a71211ef7ee", "comment": "Malware payload (Mirai)", "value": "92c7ece3c3001587852c9f38a649002da03afd8b9654449ee14d26515e61a5da9e5d3e409ce019d3ffad4737282cff67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212752, "uuid": "bb9f47ba-fe3e-48ad-bf53-8c8d7d4cb51f", "value": "T1286302CF6EB02B27D09891B5707825DADD3A9DCAE643865C83F1F2950B3943254C8B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212752, "uuid": "e8812ae3-3296-4508-881b-eb9468f44c0f", "value": "1536:1axZLmYKVDNSl2y08yumeJyGYVmIMG3Wj11ADN4:1axZLmYKX+t08jmeJhYT3BDN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763212752, "uuid": "7a6697b0-8604-4d0c-a4b1-31fc82e1a082", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763212752, "uuid": "84f28ad3-a0f5-43d3-9931-8d148e66524e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763212752, "uuid": "f35dc6e8-0bba-4d65-96c0-86eebbfba0d5", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bf2824-c1eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763187642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187642, "uuid": "72ef2b30-e218-44e9-aaf5-97a86b48c1a2", "comment": "Malware payload (Mirai)", "value": "fd2a9ddba6ce7e1bc2e793f21a9bb460", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187642, "uuid": "d5b093b0-2bcb-4acf-b3d8-2d9e878cc18a", "comment": "Malware payload (Mirai)", "value": "8994ece2c30f3a843f383c2c8f4d58173b38e2ec3be96a039fe5575426bdec14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187642, "uuid": "b4adadac-7f85-4105-aa41-d3b514db9211", "comment": "Malware payload (Mirai)", "value": "20c705ab85da05450786efa52aaff811a3936800", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763187642, "uuid": "84e6d2a8-1695-4048-8c36-ac1f4e890167", "comment": "Malware payload (Mirai)", "value": "970913b1615641e91fcc37d8c0261cd30309c76a21cee141021d62787686339c129435fdb2ff4db7966fd99a2f6e1981", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187642, "uuid": "349cb034-cfc2-4171-b077-fcbc39d1d5ec", "value": "T1A0A36CD6E283D0F5DC1605382172FB376973D9FD2328DAC7D3E49A76A822941C41EA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187642, "uuid": "38d8a0f9-1e92-4a50-ac32-8baa18514077", "value": "1536:1lJn5LL0S8uPDILJQM0FEQ5PGCykiMfj+wwlJGvN7cH78Q3SdgWLCptBL:TLvSLJQ1yQ5x/fSw4JwpcsgWLCTBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763187642, "uuid": "f0020415-d49d-44e7-b7fe-dfe53cf37042", "value": 103700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763187642, "uuid": "e579ca64-282b-430c-95f3-79b5bec96559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763187642, "uuid": "5cc31492-15fb-474a-9bf5-078cab03de25", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200dd1ea-c25a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763235278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763235278, "uuid": "8b59e1ba-d0dc-494f-9f28-b1843c03073a", "comment": "Malware payload (Mirai)", "value": "ccc6b7030fe6db3eade9628fd637d9bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763235278, "uuid": "ceb40d48-e456-44ed-a585-9de9d55046c2", "comment": "Malware payload (Mirai)", "value": "8aaee1078e9cfb6e1b002aff838a2b98e34d19bfc601d97ee7fa6868386dc2e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763235278, "uuid": "fc37ad66-cfa7-4733-b94f-5db269bacf6e", "comment": "Malware payload (Mirai)", "value": "5f36e6563fe9615a6bb7962ff5936ded3edc8e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763235278, "uuid": "f6344897-b4a2-4986-a74c-03504fbbc955", "comment": "Malware payload (Mirai)", "value": "4b57ebb1f97810aa112be94feab1869d90da094fbc952576bb2f1c895fc9a828c245196f7acd923b70f3fd8b317680e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763235278, "uuid": "b0ca682c-95a2-4fc4-9ae7-9c7389109e6e", "value": "T176437D76C41DADD0C50C12B4A8358A799F23E100975A2FF76E99C1A99047EBCF60C3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763235278, "uuid": "1818cbee-d2ab-47b3-84db-6ffd7100ee60", "value": "1536:CaUwtT8nML/rAp1ybijR+tqlP4fn46uCJZuybVR:CT7nM/cp1yba8IPJ6uIuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763235278, "uuid": "9e2bdbba-dfce-414f-b1e3-cf6fdcb6f30d", "value": 56184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763235278, "uuid": "c3fbf705-135e-4d0c-8905-2ba3e0490e24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763235278, "uuid": "04ec637b-8416-4d7c-b116-72e6d45d9314", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9954d9c0-c1dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763181795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763181795, "uuid": "9b8e5bef-e6c1-4848-ab32-916a5856b5aa", "comment": "Malware payload (Joker)", "value": "289940a870d2b2dca6085f11c056bd9b", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763181795, "uuid": "1524add2-647e-4e7d-afd4-08abd0c1288c", "comment": "Malware payload (Joker)", "value": "8ae999bc37aa7b5aa2402e3e243b9d392d4ab40f3a2f598fa6175832ad988c8b", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763181795, "uuid": "617e2bad-6538-4099-a509-8c35f8d7c786", "comment": "Malware payload (Joker)", "value": "8cba8bad95fcb05119eddff011e9337049561460", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763181795, "uuid": "fdc49f7a-b40e-46ed-bdc1-09a086434ad6", "comment": "Malware payload (Joker)", "value": "0336f7a7079161f5cf6ef82f379160b12ae144e46431e9350e303a2dec5579ce9dcc94eca413af2bdc8f67197a7cf761", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763181795, "uuid": "a0b48ca1-955f-416e-9929-358c35fa81ce", "value": "T1AAF61266F328EF1EC83784364D7E627605490C5A9F43AB136909B30C79B7AD44F4ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763181795, "uuid": "e1e72b48-08cc-4913-be2b-addea70de13c", "value": "393216:pIjM6RDuBeELdJ/vxBukgpoMjYv9jhBrqCt6gaN413V0:8M6xuXx05polJfMN0V0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763181795, "uuid": "1629a720-66b7-4730-bd57-8a4260c9342f", "value": 15953244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763181795, "uuid": "f99949e8-83f6-4316-a0ee-2b4d94ab0526", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763181795, "uuid": "f2c8c0f7-9cc1-4bf2-8001-71c11223a11d", "value": "Battery+Neon+Widget_1.3.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df4854f-c252-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763231973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231973, "uuid": "bb1731a8-0f16-4774-89ce-41071c3ede3d", "comment": "Malware payload (Mirai)", "value": "257b44dbebdabb71911e210401a23ecc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231973, "uuid": "60c15e4f-c628-4f0d-b506-fb770652e32e", "comment": "Malware payload (Mirai)", "value": "8b72d37d2e563142a0bcafc4b1e4cd7a9b1e4f97fd906e799b4a4bf8d9c250e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231973, "uuid": "ed15f468-93b7-4e02-a760-68b3677ec1bc", "comment": "Malware payload (Mirai)", "value": "ed5f96f8839e42dd5387a2d7bde62ae2555d9d36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231973, "uuid": "51bb6e2d-0e8f-4ab8-9adb-cb1f1c97d630", "comment": "Malware payload (Mirai)", "value": "9b6094efd37a098af57f4cd886ef1e3f748ef5d15bcdba523e348c381aa9ad1b076d93f2f289260a251820991db99845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231973, "uuid": "32c19444-f9ec-43e8-a5cd-f862ccbd307f", "value": "T1B8E38D62C964AE98C234C575F021FE396B538E5245835FBA5AA7CB718047DCCFE093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231973, "uuid": "16a80cbb-feda-4a4f-acef-21ed7223ec28", "value": "3072:FpMElYgbnee0PIdYuw9XMBnt4EGAEAixtWhEeOZ5l:FpDqlNNXMBneZLYhsZ5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231973, "uuid": "5302a78a-9c0b-48ae-b42d-7ba82e4b39f5", "value": 152128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231973, "uuid": "c19232eb-beb3-44d1-957b-c008941469de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231973, "uuid": "cf617e7f-1f33-4940-8db2-d78e8a3800cc", "value": "executor.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0f51dc-c237-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763220585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220585, "uuid": "276183bc-ada4-4485-beb0-16973da18945", "comment": "Malware payload (LummaStealer)", "value": "821c902db6f655fa44eec0204c0d9ecb", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220585, "uuid": "0a0153ac-efe3-4ad2-a47f-fb83ec568c61", "comment": "Malware payload (LummaStealer)", "value": "8c422b5850ca48c7ec24badee9d74467eb0426561cf60bda669c10aaab02c755", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220585, "uuid": "bf5718c6-f909-4659-85db-822085582235", "comment": "Malware payload (LummaStealer)", "value": "faba7b0c66210d335ee5a6afc0a2dfd1da9376dc", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220585, "uuid": "1f7d3423-dd86-4279-b615-5ab555453d9e", "comment": "Malware payload (LummaStealer)", "value": "beda1b0a5b30026ee8ee91038a50f62056ea58abd72a80204b37faaae7579bd418c7191b00931eea40a8f4768b0affd6", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220585, "uuid": "f36fccd5-53e0-4cf4-b676-7936a4de79eb", "value": "T17F65238662E05462E4794B7948B747125739BCA22F7053FF13D0E27E2F232C4AA36B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220585, "uuid": "a436e3ab-fbf9-495f-885f-4902952548e3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220585, "uuid": "3372096a-24a8-4d12-8bd6-49e1e0f6953d", "value": "24576:1jdyU3/p3eu9SRDv5vTkKFFjHv8zOrrZfWE7RP5Q14J7e4vxqTAcLwz2NbYyJ:1j4ah0pkKFISrz5Q14J9vQkcLw6+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220585, "uuid": "c6f186e1-e457-44e8-8bb6-4041b31e7209", "value": 1489336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220585, "uuid": "264cf65d-b892-4a21-871b-d42f2f4fecb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220585, "uuid": "567cee77-ee0a-466f-8a05-36b3d4414299", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93649633-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240626, "uuid": "db3276c9-422a-4aac-8252-4af4baeccea3", "comment": "Malware payload (Mirai)", "value": "ba5b510bd8628abe8fb26f52bdaada38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240626, "uuid": "a2bc383e-6fc3-404f-8076-1d2b86e8a8b3", "comment": "Malware payload (Mirai)", "value": "8c4cecb847f953a67c45a1f82265f9e7e1411e11ce9ac017caf60b37929f422e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240626, "uuid": "886a8c0f-610e-4d85-9ea2-a169a0483566", "comment": "Malware payload (Mirai)", "value": "2b6a0b33f539c1dbca063d6619d15622494e9f8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240626, "uuid": "08a37de4-5002-4a88-a8c5-7d98bf51d66c", "comment": "Malware payload (Mirai)", "value": "6ae78060cf705c852670d10fe21879faaefc45fdb084da0458405b9a0e35862b2296e4ff194faecd8a8a496780573b7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240626, "uuid": "4a1766fb-0639-464a-9867-8b94c3d41523", "value": "T15BA2CF55C5892F9FFE51AF7C69E195C13BB21B0732FB88F2E182CB136E12094205AD99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240626, "uuid": "0c7842e8-ee7b-4b49-878f-6326feb7950d", "value": "384:KucjyueDhUCqZpJ9uRGpQKuE4qQpZfybxXGapYVWRaY/14ZM1M4uVcqgw05VxJuk:myueFUXpfH+SCy1XGapMWRaYwX4uVcq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240626, "uuid": "d728fd78-f532-4633-a1d0-bd23a8491b92", "value": 21948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240626, "uuid": "1d89b191-6cf7-4e72-ad2a-3f53526789d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240626, "uuid": "9fb07fe2-b0a1-4d3b-928c-b4d02ff8df48", "value": "brichs.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0896bacc-c249-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763227938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763227938, "uuid": "fbdae84b-dcf2-4677-9437-17e5ca38c93a", "comment": "Malware payload (Mirai)", "value": "b4ff8ee8d6d1899e079259e764e9a74f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763227938, "uuid": "a86c9f2c-9ad7-46b4-b933-956d49417203", "comment": "Malware payload (Mirai)", "value": "8cd3535da95571a635a3237a6442789af1b8f8876c5fc14b085b09b2bc18f21e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763227938, "uuid": "ef5f0b52-6a4b-41d0-9b1e-67f9bd3b67c5", "comment": "Malware payload (Mirai)", "value": "6b27c60803be787850f6debcd1c24c13bdfd71c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763227938, "uuid": "582fea70-702e-4532-a225-d909554b2f35", "comment": "Malware payload (Mirai)", "value": "0805d5623f9a0319b3e451dc091afcc6b7b703ef4ac84baaa815b926b2fef2d476546b45bebdce861a7ea298aa9d7b22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763227938, "uuid": "f6196fe8-44e5-4432-9aab-1037faa76343", "value": "T1FDD2F1B267D5F621FB724436F8A92DC7B6AFC3E8E3A5797D25000A24D40AD5E02F4184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763227938, "uuid": "384f5753-6346-44b0-ad92-3e5481cad5b2", "value": "768:k/0sTDjgOKVYeJezgwyedubklGmi1rYROQCLIs3Uoz/l:G0sdecz5uuGmi1r6ORZzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763227938, "uuid": "24beaaab-4a38-4038-8635-1a983f910b2d", "value": 29592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763227938, "uuid": "09e40b45-e41f-452c-bfb9-223662538e6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763227938, "uuid": "a01d89f6-4426-40de-a82f-768a9fb83282", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7680623-c24c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763229519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229519, "uuid": "55dfa0f3-a101-4455-af91-b9863f939e25", "comment": "Malware payload (Mirai)", "value": "f4b72a0946c497793350b76b9e410fa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229519, "uuid": "a382e4a5-c8dd-4c62-a86e-e8657a4e2aba", "comment": "Malware payload (Mirai)", "value": "8dc34fdd0f9b236af5d88c1d4e8fb06381488dc70903f16c106d5393da816f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229519, "uuid": "7cf02440-74b9-4ea4-aec9-57a139114ae0", "comment": "Malware payload (Mirai)", "value": "3e398c5956bca922ae24ab8cbf3864bc1aa5f38f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229519, "uuid": "8b031c27-fca0-4304-98e6-40fd02a7614a", "comment": "Malware payload (Mirai)", "value": "73076987e8a3a3dae69c9c80daa5e34f0da8628e5f86c5324b1008d57c1557361a8ecba256c3e5e9dd2cc089bccebb86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229519, "uuid": "48cf54eb-a8cd-460e-a798-796643d02e84", "value": "T10A0419CBF800EDBEF40AE6364C531906B130B77214925B377257796BE93A1E94827F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229519, "uuid": "f11a4317-6da8-480d-a8e1-4eec7e483d8a", "value": "3072:NH8NUJgtzwVQ2Kybkx1zm4rkRmczL+BX3uTCK9zU7DtAVNjbiDLscW7pylIcjQ:mUJLoy4uvzL+F3M9EDt9LsjylPjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229519, "uuid": "76a05e08-9f18-44f8-adc1-2f35849ae40a", "value": 188736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229519, "uuid": "fd3189ca-527c-41e7-8fce-43ea8e104c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229519, "uuid": "1c59597a-ab1b-48b8-9f2b-f3e56c511fef", "value": "executor.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef834ee-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241531, "uuid": "b7b3ef52-bbdf-4cae-ba51-36bb14f01034", "comment": "Malware payload (Mirai)", "value": "21fe03c830c6c75c9e1d15886e5918c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241531, "uuid": "5bc86661-bf76-4282-b490-8a369faedbbb", "comment": "Malware payload (Mirai)", "value": "8e4cd99dcb2c2ab654079b0051a29580ff9f9bb1c8b59da2430b2197054cc4c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241531, "uuid": "837972d8-db80-45cc-9e16-f58f90d1c4d7", "comment": "Malware payload (Mirai)", "value": "111608ad520eadb888fe29e83058c93dd4ea334a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241531, "uuid": "bb033dd6-a2be-4d98-8c41-01097c358f4b", "comment": "Malware payload (Mirai)", "value": "7679f31458e954177f85767b5feb9a47229d30fb327bd904875d0097ef6731d426b078928522dc6579b0cdf987663288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241531, "uuid": "0fcfd7f4-76db-48fc-9516-e3160f39267f", "value": "T1AD534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241531, "uuid": "82364e40-9615-4e9c-86df-23edead39cad", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/kDiQfLiKimfFoktCe3fYRMc:WShU3q7cEDlCK/kDH9i8Fok06fYR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241531, "uuid": "985afb53-3e89-484d-802c-55e275b1a7c2", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241531, "uuid": "93639d56-ec49-4544-a331-2bbb4f3bf3bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241531, "uuid": "ebde61e5-4efa-4d47-a62c-3ca8f619ea4b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995521bd-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240636, "uuid": "9a078f73-4f19-4dfb-b68e-a20a18349d2a", "comment": "Malware payload (Mirai)", "value": "53924238486e063646e9c36a14021363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240636, "uuid": "4a8da25a-e46e-471e-9b78-a8b0cb064cac", "comment": "Malware payload (Mirai)", "value": "8e95d0e5a267ca6481cfd7fc45c06780b2a047ccd090f500878528181eb60172", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240636, "uuid": "5e453fbd-a940-40f3-bd03-8fe2d04e33b4", "comment": "Malware payload (Mirai)", "value": "8db917f702d31b35e0474565a95671b863fc0072", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240636, "uuid": "91096d56-4500-4253-bef8-c0e76f6da946", "comment": "Malware payload (Mirai)", "value": "334de025da43adacf80735b867ccf788d7797a6c3a118b28444ab15d6097c3a89a294f1c819b4a217baa849d9d562d86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240636, "uuid": "7796b61d-f3c9-4880-9c2d-2db7a97ac956", "value": "T1D7432921BA3A1B23C0D4A47D21FB4B59B1B15ADE26A4C64E7D720F4FFF216806943DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240636, "uuid": "c3eb378c-1ba3-47de-824c-dde6c64d3adb", "value": "1536:y+ZaHhc6uVw4IUDsprf+U37nTvV5TX10QnrR:5ImO17np5508rR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240636, "uuid": "ba43d627-6986-4d9a-a861-7ad1dc96c1b9", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240636, "uuid": "092ab2f3-e824-4382-bdcf-916b1bf893ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240636, "uuid": "e1368d31-cc2b-47fe-99cd-9a1265f40557", "value": "brichs.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a271d1e9-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200708, "uuid": "8a6a6847-d71c-439e-9807-0e9271a0d366", "comment": "Malware payload (Mirai)", "value": "a0e47aa6ca84bb984d7930929af5626c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200708, "uuid": "0d02972b-52b5-4059-ad25-84725622994a", "comment": "Malware payload (Mirai)", "value": "8ec4a1f6e5dd6fc3a10658e8982237d26c8a078498f3865120019869efb7f03f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200708, "uuid": "7e5991b5-9337-447a-8367-85b3002b334a", "comment": "Malware payload (Mirai)", "value": "47876c30be654c2e5ff8dd92a75f8a6d70122758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200708, "uuid": "8712b93e-2a9d-45c6-95db-c9a2002bc5da", "comment": "Malware payload (Mirai)", "value": "423434fe28fff3bf82231b0071e0cea0ea4a9315352d85d45ebb338551bf6b130c4d8261f9fa15611040b65c67b461b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200708, "uuid": "8bb6be49-60e4-4f63-aaf4-c57ca14c4746", "value": "T1E5734A48E647D5F5EC0705702157EB3A9E31EE350224EA6BDB94FF33A873A52E04A21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200708, "uuid": "2e89a89a-ae47-4ec9-b592-d63aa33f98f4", "value": "1536:G3aiNKH5F+mi7gzgh1956XrGZkkM4CAUJ31UNFC44r:GKicZF+mDzE9kXrIkv+N9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200708, "uuid": "a2b3ae16-867e-4e13-be5a-ae5cd887072c", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200708, "uuid": "890ffeef-e5d9-4b1f-af9c-1b5226300e53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200708, "uuid": "c8bd93c8-f869-4970-991e-499361325f8f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6080a3-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239893, "uuid": "9fd16e05-ed41-46dd-a433-dc555ccdf24d", "comment": "Malware payload (Mirai)", "value": "dbedd9d25d6dc0eb4559e9883c7e5a64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239893, "uuid": "2f30595c-95a5-45d8-8e99-16934398cc77", "comment": "Malware payload (Mirai)", "value": "8f37596c478261c24884c83ce6d8f67f08bbc4d31294dffff53bc766da43e902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239893, "uuid": "487591b4-a093-4b10-9d61-a3bdb793f7a3", "comment": "Malware payload (Mirai)", "value": "23d42729cf8e00da00b82dce1ed059199e74a622", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239893, "uuid": "0499ff4b-a3fa-4690-9b53-12b3ea054632", "comment": "Malware payload (Mirai)", "value": "79b749d8fedd43f745809a8067ea96e48e006a9781462af40d52c2f552b9aaf8473ae29bd6ac78f828b38cdb0e8edc6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239893, "uuid": "939095bb-4c38-40d3-981d-a7bfbae1d649", "value": "T14BE34D9AF402DE7EFC0BE5BE44670E15F931A3A13143172A5297FDA3AC321A51D16EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239893, "uuid": "da1c4064-7651-4b64-8270-d74422eb1a7a", "value": "3072:TgARhiJocEuvhGzdl06BZYCc0JXPsMJiT7DyYSm:hMocEuvc5BZjxPsMMuYSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239893, "uuid": "1e397d94-3303-4252-b512-1e3210b5c8e4", "value": 146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239893, "uuid": "f136f8b9-2dca-4f77-b825-d14569a2e62a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239893, "uuid": "36d555a0-e040-4c7d-82a2-4cb92317c038", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16db889d-c202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763197467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197467, "uuid": "8874425f-43be-4acd-ac01-05a96f806497", "comment": "Malware payload (Mirai)", "value": "e0ecce9a58fa9cd38f425847c1f99734", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197467, "uuid": "5585e8ce-8532-4278-9382-3d8279af071c", "comment": "Malware payload (Mirai)", "value": "8fb022bc65b816891acacc9b7af5ed67a7bb3765ab090b32ee31e2ba439b8a40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197467, "uuid": "e7a42560-6a86-49b2-b426-1f8d58c348be", "comment": "Malware payload (Mirai)", "value": "43d6eb03693da843208ede321801ceeb65b30037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197467, "uuid": "d7f390d4-488e-4867-888e-4cd3cef94b85", "comment": "Malware payload (Mirai)", "value": "ac9b197bfc6507080712c61e21c92b327e444ba0e99ff555c8f36fea7d76e3c7504bad6bd6abe79092044deb2e47845d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197467, "uuid": "a04a356f-2f18-49b5-9b91-94dbb46a830a", "value": "T161730745F8818A12C5D612BBFA6E028D373657ECD2EBB2139E216F2137C6D2B0D37945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197467, "uuid": "8a5e965c-508c-448e-afe5-475e348caed9", "value": "1536:Bj2/jQ4mdl+WnieLxJxlAA9s5v5VAZ1lSfFXaE7hVq7QWzNIvBWOh:H98qHfAAG5vCbSfFXaE9Vq7QWoBXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763197467, "uuid": "5d1a5693-989a-413a-b71e-e506f3c43971", "value": 78936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763197467, "uuid": "73b78cf2-4545-49b7-87ce-e02ca92d9223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197467, "uuid": "8bb87e02-e289-4460-9d7d-c87aa1177996", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbcafd1-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239895, "uuid": "f90e9062-a9c2-4989-bf2c-b1abab696027", "comment": "Malware payload (Mirai)", "value": "0550bbd6e6eedc8795c5d4c480e1b884", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239895, "uuid": "6733f10e-9cfb-4b37-94f0-53ed03129179", "comment": "Malware payload (Mirai)", "value": "93407d9d0b3d019246fa31e52d2869151756e527a2fe0244a950c7ee5afcd520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239895, "uuid": "bbdbc6a1-7e8a-491a-8a27-590dbf395d27", "comment": "Malware payload (Mirai)", "value": "d5c3384ee5a314fc1379e1c383df7bfb8b304890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239895, "uuid": "3891d53b-04ab-42d6-b9fe-444e2faf6667", "comment": "Malware payload (Mirai)", "value": "68277aeb6164715a26c4069893f3a667bc143d6b8787daeacc0f5bb872566c91a622cdc488aabfb1cddab2b9dfacfb30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239895, "uuid": "9d141543-5a66-4979-91f7-55008fb40cbb", "value": "T11793E651BC82562BC5E423BAB67E668D33A577E5C2DF722BC8214B10BB8550F0D63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239895, "uuid": "5afc3bc7-0726-4183-99a5-44e392ac3ecd", "value": "1536:OZPHd+RK338ULq/haiFVGg4yWWCLiEsNiwEzHcf2j75XQIfBfl:Oj+Rq8UL0V2txwL+75Xrpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239895, "uuid": "4cbe238a-14fb-478e-9146-6fb26605005c", "value": 93748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239895, "uuid": "83fb4b4f-5f92-4157-b298-ff295732fd62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239895, "uuid": "a1f15cd9-d74d-4846-b70c-37803f675874", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876acf99-c200-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763196797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763196797, "uuid": "b03749f6-9cc2-47d6-82b6-849fd71c2cb7", "comment": "Malware payload", "value": "fc5d0ccf5f5eb17d2321155107974ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763196797, "uuid": "92285d6a-b111-47fe-8172-b385bacb42af", "comment": "Malware payload", "value": "937ab37bf1f1df7bf66f9df7e31d8b10b2114edfdf741f498f2efec5eb13354a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763196797, "uuid": "ea732b86-f953-4333-bbb4-551a86c1a9a3", "comment": "Malware payload", "value": "54f224b9561a8e8e84a1f34bf34a522534153662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763196797, "uuid": "d6f1f32d-c8b5-4aa3-995b-c8f113351fd7", "comment": "Malware payload", "value": "f6433089e9c70d4f636f743ff82da7f8f4a7c0c957a7dae5536e4ead98517e7ab85c8817cb2ac5347762ccaf88ad919c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763196797, "uuid": "44c9499c-21e3-4fc5-8c3d-659558cb76f3", "value": "T1B7283367B24D5AACCA2356B9C066D734A2BE7E345516CF0B41F07D1FBEBB0400E6DA42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763196797, "uuid": "487d7630-eb04-421c-81bd-324ab21a123e", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763196797, "uuid": "182c3b4d-8f2d-46f5-a4df-43cdd25fc492", "value": "1572864:tURJiIu7Pd3Yq/m2S7W9B+9c2tUW+Qw2YFxyiJqXQa8EcNusdkKfsgD:GRJiIA3C7WwDLYymNlkK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763196797, "uuid": "e2f77fd3-5a6b-4b8e-829d-63799106d437", "value": 95270400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763196797, "uuid": "d4d06d98-6599-404d-9ba4-dcb0cdbca2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763196797, "uuid": "c4a14a5a-34e7-4913-9996-cf65dc55776c", "value": "stan_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9880088-c1de-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763182386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763182386, "uuid": "ed0377b3-e397-4819-ad31-80ac0c03a521", "comment": "Malware payload (LummaStealer)", "value": "bd3f8f2a89f929f55cbfb53c4d314733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763182386, "uuid": "3920a682-4e54-49dd-bd0b-49d49c488125", "comment": "Malware payload (LummaStealer)", "value": "9503fc10b47bb1bbc62596a15a73b247fb10cc565369cbd6e319329c7746342b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763182386, "uuid": "acb3ab60-65b2-4361-a85f-e88930b85ada", "comment": "Malware payload (LummaStealer)", "value": "db15da2af8f4a5cf1aa724b9dad63cee7a8eb9e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763182386, "uuid": "61c517e4-c4c7-463a-be42-f119e82d7ccf", "comment": "Malware payload (LummaStealer)", "value": "c9a3766c7456ea5c5226d87f7d3c82ee1b0469b20dfe2e9704ad64f822e9bfe6cfbf68397b995506e1bfeab26ac602af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763182386, "uuid": "26f79750-3fbc-443f-b232-20a44c274dc3", "value": "T17265230173F92892ECB94BB084F2429749317CB66F9582FF62C9A23F5E235D19076B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763182386, "uuid": "ab968721-1ae5-45ff-a719-75b2cf26552a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763182386, "uuid": "dec9f155-fe07-4dd9-a02e-c5241a1ee06c", "value": "24576:pjly74LXJC9z7ZxQpjfbfOEtJxaCZKsyex/FcyJvnekGPaLTUONxnoGHV:pjAeC9zvK3f5naeKpw/FDekvLTUOMGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763182386, "uuid": "dbebbeac-2e40-4a2d-a24b-11dad638f55e", "value": 1433600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763182386, "uuid": "77911b37-3b40-44cc-8901-2b9be343d1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763182386, "uuid": "c8dae83b-f389-4b1b-b2b8-cfd15c592876", "value": "SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab7d730-c1f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763193984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193984, "uuid": "109f91d1-ed54-4d25-bc0d-72784237d021", "comment": "Malware payload (Mirai)", "value": "db6026b6164e29c9904aaef477733d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193984, "uuid": "c4c9f504-c8db-428c-9ade-07e5d91c931e", "comment": "Malware payload (Mirai)", "value": "95ef3e464a0cf39246c8e644883b5b44c55de71d23ec924ffb5a020fda61e465", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193984, "uuid": "4d3e3be0-433f-46bf-acf1-37876bb8d6c9", "comment": "Malware payload (Mirai)", "value": "79e02610f98b51ee3ea75cd479b10620d9e6e78d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193984, "uuid": "34dd5a68-dcdd-4c88-9762-07b5c6b14bee", "comment": "Malware payload (Mirai)", "value": "e6d28c955c94e229d59f4e24c55332578e729169c1e5bfc34668110c7c58a9d724e26579817bacf5facbbf5c05c1e091", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193984, "uuid": "e57aead2-6f2a-41a2-9022-40ff6e22c9d3", "value": "T1D513F190C2362E8FDDFD1DB24742C29A37F14FEAAF908F575095F7410B62962A94C784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193984, "uuid": "90c7ea7c-a1c5-4682-8f96-98e09a41318a", "value": "768:7rliR6IFX95h5DrmisrqY/bPUoeDayhhVS6peiP+GjR9t4uVcqgw09g:7xiR6IFXfh53Ls5DU1Ddfo6p3F4u+qgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763193984, "uuid": "d8bd5142-acc6-4c96-a58b-5d5ec28b61dd", "value": 43572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763193984, "uuid": "fe1d635d-afd6-4b7c-9335-819c99457a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193984, "uuid": "7ce69bf9-7b45-48c6-9b91-802f3bfacd15", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb2032d-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239892, "uuid": "636de84a-acd0-4a72-9ba0-79c5d77ded5c", "comment": "Malware payload (Mirai)", "value": "6d121ca7a64e60cac3293cbafbccfec7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239892, "uuid": "fd9c1b66-5e4e-41fe-b246-d0515f08a963", "comment": "Malware payload (Mirai)", "value": "97b8f890d1c48ebf72004ea561bf43ae33ed46332c07497db3c7853e2600d877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239892, "uuid": "d7e5b3b4-cea1-4c43-a263-370bf06e607f", "comment": "Malware payload (Mirai)", "value": "a47149c108f7821a554f57df637796d00195343a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239892, "uuid": "b6787b6b-4ebc-4637-84c4-b7145a85cff1", "comment": "Malware payload (Mirai)", "value": "a8f3f167156c8732306f0c3abab76a4dbf83a3f0b657ff6313aed853a95017efb26691a52e2709cc976fc4f5bcb46f18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239892, "uuid": "6f77427c-b4cb-4f9e-bb9c-21441f662b33", "value": "T17CE34B55B8828A22C9D513BEF92E018E331327A8E2DF7213DD205F2577C796B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239892, "uuid": "341e4684-25e9-4200-b090-15715213504f", "value": "3072:Kp4l3AUFto2aEipqlzXdaVMda/TGjdVkUYEs4kV:NlHto2aDpq3aKdaMwUYEkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239892, "uuid": "84409735-fa2f-4242-abe8-a7ef49c0e3f8", "value": 145544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239892, "uuid": "3045f576-77d2-44b3-8ce3-8c2fbbce9611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239892, "uuid": "03251e3c-08a0-41a8-a0b4-f16858ca103c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb974d4-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240779, "uuid": "acc880e5-67ad-4891-a864-b46dd0a0682f", "comment": "Malware payload (Mirai)", "value": "bc6546f222120c36b199cfe922cfba2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240779, "uuid": "d3cc0985-83e6-43fa-8cd1-10a180ebdddc", "comment": "Malware payload (Mirai)", "value": "9952edfb3327dd3eefab4d11eb26524954f37499c9630fdffb9fff25a4f60793", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240779, "uuid": "e13b670b-7f42-4158-8b77-71e4e8387f2a", "comment": "Malware payload (Mirai)", "value": "071ed182390e600c9d729894c445dde793982f2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240779, "uuid": "d28a1788-cf6d-41b3-bc07-4c5cf71b6dde", "comment": "Malware payload (Mirai)", "value": "572595547de4092f0bc9360794cfcc58818adf4ce47f02d036d81a465fea69491104353082b240a9a9edf023aa49c6e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240779, "uuid": "6238ba77-03d5-4bd3-9da4-8bdb9443a0c1", "value": "T113D35B42EA418F13C0D2177AB6EF42493322A795A3DB730699249FB43F8275F0E67A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240779, "uuid": "6b56ea08-b5ff-4a8e-9550-d3e96b5b46ef", "value": "3072:r2kkqDmCJJ0pZ4kQrtyKa0TKko4KNQgM/9R2+r:r2kkqDmCJJ0p+kQrtyKrTa4KNPM/9E+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240779, "uuid": "04a2473b-399a-48c6-9dfb-c3df2cecfacc", "value": 130240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240779, "uuid": "e5499a0b-c2a2-4be4-9702-837d5f654ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240779, "uuid": "0586dad2-c7fa-42c0-b098-5d98a03a0d56", "value": "brichs.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb9e32b-c1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763175791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175791, "uuid": "b4302a65-acfb-4272-86b3-df3639e9c687", "comment": "Malware payload (Mirai)", "value": "e46ade238b89f389b607a320d71a0bb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175791, "uuid": "a22db1d8-e2b2-45df-be55-cc06550791c3", "comment": "Malware payload (Mirai)", "value": "9a864ac0e9165935a27ef4a613402b72220e12ef6bac8ce6c366d5af6ac7ad93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175791, "uuid": "940c85a8-9a29-47bb-b3ab-8face491fd58", "comment": "Malware payload (Mirai)", "value": "8d821b933f66947ddf2632e94e4c8a8d9b9c3c5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175791, "uuid": "0d5e1877-1c0f-4d10-ab3b-d359af82da72", "comment": "Malware payload (Mirai)", "value": "ca5bab788a8bd8edc0748afa164c3b42203588ed7797f429c3cb6ecbfa6ceeb2d732dd475e21c9270d18ec690afb74bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175791, "uuid": "e1e0f157-016b-4aa4-8136-d9189f40d470", "value": "T1CCE30806AF510FFBD86BDE7702E90B1635CCB81712A62B793138ED18B60A58B59D3D34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175791, "uuid": "963da67d-d5ef-4eba-a8b0-3ad2f601da7b", "value": "3072:v9tIBrkxxcC16LvswzANjHi3Amrjs18NKZw9w:vyrkx6gwzMHmrje8Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763175791, "uuid": "e9a85832-af29-4810-96e8-a3be67b8f4d7", "value": 155420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763175791, "uuid": "c34465f5-412f-44aa-aa1c-ab30490aca74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175791, "uuid": "0c3b7234-b089-4ce3-984e-693c0fad7ece", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d27cea-c26b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763242616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242616, "uuid": "b8feeb55-e9d9-4b3a-b245-1cd8cdd57a15", "comment": "Malware payload", "value": "aaca1d8777358900ce228a8065dbac5f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "Tool.BtcMine", "colour": "#779003", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242616, "uuid": "f37ac5b6-2144-4a0c-a6bb-73f64f6613ee", "comment": "Malware payload", "value": "9bfefb7c0fe8e0cd3860f200eb8c45224a00ebc85ad4f6f93c74f4dc3f18fd23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "Tool.BtcMine", "colour": "#779003", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242616, "uuid": "30cc7bb2-c1a8-4069-8f82-b440815d75bd", "comment": "Malware payload", "value": "b09dd2a53d9392710d7132dc79b5168229af8006", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "Tool.BtcMine", "colour": "#779003", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242616, "uuid": "8f76ea1e-bd80-4c87-937c-cbd9a2071ac6", "comment": "Malware payload", "value": "eb9b23f5bd864dcdb7ccdade7fd362281e977c29a642a730e7839f4bd8fa13b5ceff435457917d87b239e24be366b4c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "Tool.BtcMine", "colour": "#779003", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242616, "uuid": "1080c768-4649-40fb-94ed-b47e552cd43c", "value": "T174849D0EA315563AC92C28F38E7700F697F1926E753FE6650CA7A1077DE25F1210A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242616, "uuid": "bf8b2065-85a7-401b-ab88-5629d213b2c3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242616, "uuid": "cb6712fa-d4f6-4360-afbf-7239976347ab", "value": "6144:ckzvlooI0vabcJzRhXy8022Y2Ra9v1UOLaQZNpSw6+cxbtMEw75fgC/FDVY3E:nvlouze8zyuvWsfN4nbtMVfrFD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763242616, "uuid": "6d4040fd-91d8-4742-8d0f-6d55ce17f7c9", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763242616, "uuid": "f000c078-6394-4792-8d9c-b569139274ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242616, "uuid": "7566340b-302c-441a-b11c-38a268163b6e", "value": "i.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e16d06-c1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763166267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166267, "uuid": "a0b21df4-baa8-447e-81af-ffe079af299d", "comment": "Malware payload (Mirai)", "value": "13df5b0ce377a2ab6b407fd19a3c86a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166267, "uuid": "77747eab-5d9d-4259-9561-0e3fe083f87a", "comment": "Malware payload (Mirai)", "value": "9c1f3bfe26c18c16bd2d38078d7c1bf8cd9881e65a84b0c0a6ed6d191ee4277e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166267, "uuid": "77502f72-cc09-4be3-b11b-e2d4c80bfbb0", "comment": "Malware payload (Mirai)", "value": "c0361425cdddd3ecc0bf1d05bdee0554821653dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166267, "uuid": "02c3b40a-79ce-4cd9-9fe4-fda974831d95", "comment": "Malware payload (Mirai)", "value": "75cafc7e49084947eaa43ba7d78218b5797b8e726cd7a8f34f68643c5e92c931f9556721c0ea687de29dc768f9b5562a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166267, "uuid": "3b5f1eef-220b-4614-ab6f-a609b149dc07", "value": "T1C3833B917D416A12C2E5237BFB2E428D331663A8D2DF721BCD226F103BC691B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166267, "uuid": "d47aa318-7750-467e-a760-1fb007910f81", "value": "1536:COgSflyCJYffcb9KfX0K3rEbyctjhY6Cg9TW7r8zdt6umTIO/vFVGdIr5evZsU7X:COgceng8vZsdVCgtyr8dt2KNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763166267, "uuid": "4959e920-4a05-4c7b-999c-4904194fde0b", "value": 87176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763166267, "uuid": "460cf353-b844-44e7-80bf-31074805d4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166267, "uuid": "37186530-7dca-418c-89e1-76f4031beca8", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf321aa0-c249-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763228244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228244, "uuid": "88e186a4-1082-4a2e-99fd-0a49ece90143", "comment": "Malware payload (Mirai)", "value": "20f54ae7e16aee93ebbb01a699444291", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228244, "uuid": "4a32c52e-3171-4883-be59-4929f00c306c", "comment": "Malware payload (Mirai)", "value": "9c75a3ef8598d777221938c56699ce9a3fc94c18593fcad1c7983370fda15ee1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228244, "uuid": "c063c637-aaac-4d0f-9f7d-102aa64a1c40", "comment": "Malware payload (Mirai)", "value": "0f90ac72af318127f70090fb02971052151d4581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228244, "uuid": "743c4f92-9b56-4236-b28e-e85e1033b468", "comment": "Malware payload (Mirai)", "value": "1eb4723de625f5d60ca90a3a7d604597ef49ed3e1d8d2aba933e8d34edea78717f9f1e071a66d486832557fcec8c936f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228244, "uuid": "2c2bed29-6afa-4575-8d58-7d7942e98388", "value": "T11324E60AABA10EFBE8AFCD3706E9170224CC651721B97F3A7674C518F50A64B59E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228244, "uuid": "a09cee71-455e-451c-bba1-c9b87dc4733a", "value": "6144:BiheUb0udZSo52QgnfVI2ulCrfN7vaxn:BihvTElu2N7vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763228244, "uuid": "190fb13b-7c89-4aa0-8d82-9be69ff17e13", "value": 227128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763228244, "uuid": "a1ef32cb-f93b-440f-9e81-83e14e62258d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228244, "uuid": "f102d0d4-690b-490d-9ad5-831dafbaa888", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df68427d-c1be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763168598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168598, "uuid": "af214992-9804-478f-ab04-31e7e8beb8df", "comment": "Malware payload (Mirai)", "value": "cccb652a7875c089e672f1f4a52adaad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168598, "uuid": "e457a73f-f696-4c40-acf6-be41a23d563e", "comment": "Malware payload (Mirai)", "value": "9cd34255180c429b239d9cd215d7f1193df2f1017c02a28f478a7be87bf0a6b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168598, "uuid": "edef244a-26c0-4c19-bc5c-f25ffae8e1cb", "comment": "Malware payload (Mirai)", "value": "fe79979e5daf712435ca89fa8602baba9ede1964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168598, "uuid": "ad898cd2-55f0-44ec-a8e7-3e968319e359", "comment": "Malware payload (Mirai)", "value": "2cbb712cc8cf02d4d465f800b30f88aa412e34b08db21d3c53365030ea9b1885b6405da20aa115a22f5db9d1f7d3daaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168598, "uuid": "5e5f8700-4855-4ee3-b565-3891e7367f89", "value": "T1BDD2E0C0520EBAD0C275A478853EC24327B0777996FE3A324668C50A87C684F757F9F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168598, "uuid": "f9defde6-c668-480d-8f05-2e6823ef0f14", "value": "768:UYpvmVZt5hhw60+9NLcmsRfgGWK9bux3s3Uoz2o:UYKDhhU+rFsRjl0qz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763168598, "uuid": "e493b417-083b-4452-93af-85ed0fc7bd93", "value": 29116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763168598, "uuid": "72ead141-d4d9-43ac-bf95-a91e9cd2b6fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168598, "uuid": "3cf51bd6-71dd-4fd4-b2fa-eebc2235d794", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b300f8f5-c22c-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763215768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215768, "uuid": "2fc5e743-1817-41a5-a4ed-aea2c1964aa1", "comment": "Malware payload (ACRStealer)", "value": "67df082bd89a2b6b4081832ed5a76851", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215768, "uuid": "f858b29b-6257-45e8-98c4-f9104e862af9", "comment": "Malware payload (ACRStealer)", "value": "9cfc92c44f42f3365b161c77347b2161e556abf68dc29a836c96bdc671538a72", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215768, "uuid": "0c7a411e-e93d-494a-a4c4-299aa2039abc", "comment": "Malware payload (ACRStealer)", "value": "67dbd2cb39f9e289348b62ab5b0526eeea302618", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763215768, "uuid": "c09af9e5-fb47-4e76-935b-2b9a55b296f5", "comment": "Malware payload (ACRStealer)", "value": "58328ccb1f53b57bffc41feccba7d1982b4837a0150ae632a9de710e37aa3189090b6fc5c917110ac4632ee856309554", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215768, "uuid": "9d9acb03-9d4f-42e1-baff-7c771d4db41d", "value": "T1A1C633479799CCE1EAE68031E4E33B8E9EDB97A5C4CE123F5C1B2212505DA6703EC51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215768, "uuid": "d55e003f-7e96-4454-9b4f-9f00a6fe8c92", "value": "196608:gCXia6i3NETOKXlhk7Uxic/AzrpMmIgll5AZ0gOqclaL4dlqJM0lfpWvT+IfqU3M:g2ia6KETRXHHPAzNMmIu8Z0/UaaMqEqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763215768, "uuid": "9d37f00c-b856-4cab-959d-14f0b9cfabed", "value": 12580001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763215768, "uuid": "e6835fca-255c-4996-93dc-cb3261ca3dc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763215768, "uuid": "cf7d766d-31b6-42c2-9081-de197bcbc260", "value": "setup activated.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c51ffda-c1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763171760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171760, "uuid": "eeb7f34c-97a7-4bcc-9b40-4dde59e0faaa", "comment": "Malware payload (Mirai)", "value": "ead62e63875ddaddbeb3e34dc6b2b815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171760, "uuid": "28f05712-a661-42f5-9a5b-9358016db3d3", "comment": "Malware payload (Mirai)", "value": "a0882db369597441beaa7031b35e49cc3d04426c9122bf55d8cf3fd80810e81d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171760, "uuid": "145248ae-06b0-45a0-97c3-f020c1e82e47", "comment": "Malware payload (Mirai)", "value": "9f808d92d314a4f4553b75ccfbaa7b8630d7e84a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763171760, "uuid": "6ad83cf7-9b13-49d1-9a34-a949ce5068c8", "comment": "Malware payload (Mirai)", "value": "eff3e198509c1abc0ba7bc42c6d8f5284f2e23018d1aa9f5cb02796235da280645c7e1507ccbb99db3b7c83ac33bb63d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171760, "uuid": "4d73bd54-d69f-4482-8b44-326523ba37b2", "value": "T1E0A3BF23D81A5D94C15405B8B4E5AE372B23E5C016931EF726EAC67A9047FE8F40AFF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171760, "uuid": "e6705f72-f387-479c-aefb-61c49538c038", "value": "3072:W9J/fGeLKoGeRoTC/IJiAEx3i4w0D6wb:W9RFKYZIbADD6wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763171760, "uuid": "623eb4d8-1091-4bb0-8985-0f37cd5c4b8c", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763171760, "uuid": "2bc47ba2-22cc-4eb5-8290-f1b717668c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763171760, "uuid": "4953273f-60ea-4974-bf10-f84b5d5823c0", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2651572-c20b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763201594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763201594, "uuid": "7c6773ca-e4aa-45bb-a467-78c0e287241d", "comment": "Malware payload", "value": "ce751ba6d4b6a5d58bcce2306f56d408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763201594, "uuid": "16038a0c-5970-4f13-b220-46316b21b77c", "comment": "Malware payload", "value": "a18c29c72d1808477727ec2a611cee0f22ecd435457265bcf10823e0980c3636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763201594, "uuid": "1385ca9e-c35e-433a-8a14-f58cfe915bcf", "comment": "Malware payload", "value": "36036f39eaa64f6891996c70b489524befd36f5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763201594, "uuid": "8c5822a8-3a3f-49d9-aeb1-338f169cfd57", "comment": "Malware payload", "value": "b61b060b7c3e995264183b32af2694e09502a9b198d5109b3016fba7fbe86a5dfc3cc81018169bd261b2f35da00a9843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763201594, "uuid": "e4540f22-94d2-4d66-b83b-ba0823a1b2ce", "value": "T14233D73BB592CAB5D0C6D3742EDB84A0F13070F15B32620F361B477A6B02B98DB5E619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763201594, "uuid": "3406f97f-686a-4b7f-a97b-0ccfacc6f590", "value": "768:8SJqBpTz/TaUrr2cUXMCnDp2PzCnJETrX:8ScTaUrsdJEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763201594, "uuid": "f2e1b4db-39f1-4af2-a617-bb50f33a10f0", "value": 52152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763201594, "uuid": "8cf41540-077a-4e52-b41d-21c6fce07eda", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763201594, "uuid": "50f624a8-93b9-49a0-bfa9-ffde142c9f10", "value": "agent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665947d2-c24d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763229813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229813, "uuid": "ee0ecb7b-7d86-4371-8654-cebadc8b64e1", "comment": "Malware payload (Mirai)", "value": "812706da27a6e1df973d31e01d362df1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229813, "uuid": "f61b223b-0413-4a77-8c8b-118ee3f1a63a", "comment": "Malware payload (Mirai)", "value": "a36884e4b39d580756fd9b6dbe4354a9493ff17885c0aee68288abd056f63b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229813, "uuid": "c94b1ebf-d694-4b22-adac-18c96faca20d", "comment": "Malware payload (Mirai)", "value": "cf5a6a6b80337e581dbc9b1eb8bf3098fdce81fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229813, "uuid": "98fc2618-8350-46d9-b8f4-8fc29998b967", "comment": "Malware payload (Mirai)", "value": "f245fa6cf26e06fd6ac0cfc15d80ff9ac53fb8ac8e28d897960fdebb76293e526e77b17ba457a29b64a54fffe4bda9f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229813, "uuid": "84485cc6-479b-46d4-9d7b-98b260425619", "value": "T1A5040946F8C19B11D5D112BEFA1E528E33235B78E2DE3212AD255B21378B9BB0F3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229813, "uuid": "31e07dd0-7701-4c23-880c-10fa5128b20c", "value": "3072:FuJ67w4h0TfPuq3UYCFb0Xh0Kf4SSarpKFHibt/edphE17n:cJ6U+0Ln3z+0XO44FaE0btYphE17n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229813, "uuid": "830c8c0a-7e65-4945-abb1-a0a82a5f5dc9", "value": 183388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229813, "uuid": "584f13e0-777b-4e5a-969a-8a434564a415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229813, "uuid": "26fee0f7-2573-45f3-9825-c5e3d8694cc7", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4186b28b-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241348, "uuid": "3f22fb51-f8e8-49c3-8d73-196f7abca65e", "comment": "Malware payload (Mirai)", "value": "ffbdfa555d598ee72cbdebd6470aff0b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241348, "uuid": "43d07273-2278-4828-b3a1-fb5db14a0d2f", "comment": "Malware payload (Mirai)", "value": "a3b8c454f347d84bd032f44a6e6c5700066d5c9136acc35d5a6065d2935ba366", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241348, "uuid": "564f67f8-6120-49aa-a38d-5cd4f2477fd5", "comment": "Malware payload (Mirai)", "value": "40d11c93cff728d8dc1d78854f46088c6dbda213", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241348, "uuid": "ba6a7c2d-eba1-41b3-ac21-835f4551087f", "comment": "Malware payload (Mirai)", "value": "0ea7232aecf78327cd7be5cb9b4b587c8451f23daa9ef334bd126abe6253931f733640fbf7df5d2c172b1183b7b70f3e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241348, "uuid": "a82b35ba-eb3f-4318-991c-cb6ae2d96631", "value": "T14C0175AC2AE1237B1624DF1CA067C0C970018DC635B15B19E4EA6FF498D9305BE1427E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241348, "uuid": "9e96267e-eac7-46dd-b219-370d28118889", "value": "12:3J3DLi3NNIl5wu0LKJVOY2e6xNMeoSwZtiFvzzvBU:3J3P0NI7KKLFSGHtUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241348, "uuid": "e90f8bb7-1f36-456a-8635-8baa1438320a", "value": 718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241348, "uuid": "ba98fa97-0633-43c7-a64f-246350e1c249", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241348, "uuid": "ab4d4213-37da-4b24-b529-e20032e6d49b", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214c37df-c1fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763194049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763194049, "uuid": "0b12118c-d2dc-44cc-811e-6c40b0e240e3", "comment": "Malware payload (Mirai)", "value": "3775c779d6140b945eb34484d79866a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763194049, "uuid": "c085614f-8df1-451b-a35d-7f5be89f9e4a", "comment": "Malware payload (Mirai)", "value": "a57b8859ab63895e701aab2529a09451e2b90b93101071e5903b8688b878bbc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763194049, "uuid": "3e501e66-9f9c-4f98-ac9e-a05cf2de83e1", "comment": "Malware payload (Mirai)", "value": "41e29f992a88a1db25ea5d70e6008a3fc5103a93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763194049, "uuid": "df6fc079-0f9f-4118-ad9f-650b07cf2468", "comment": "Malware payload (Mirai)", "value": "bb0caa0b524334acf4290f4c3ac6d24e3c62930660a4075ae9b42a13ba39b756420710d73cbd91a3eecc6fa00f79607d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763194049, "uuid": "0a3f9a23-1821-408d-b11d-510725e0343b", "value": "T180B34B52730C0B47C19709B02E3F6BE687BEE5D121E4BA89251FDB7686B1E371449EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763194049, "uuid": "3ec62eba-f5b3-4c7c-a3fc-7c3ef9921747", "value": "1536:/V3wo27Gz/nWnFjFep9KKXdUhJ9p+puaZn3K8V8nj:/V3wfXFjFGPs90uWUnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763194049, "uuid": "d3e93974-aaed-49ea-9915-bc49abf4222c", "value": 108108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763194049, "uuid": "065d8202-4969-4f81-8450-ce44ade4a90d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763194049, "uuid": "acbee5d7-7e21-4505-be59-e19472f9f806", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac30b13f-c205-11f0-a129-42010a9c0007", "comment": "Malware payload (44CaliberStealer)", "timestamp": 1763199006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199006, "uuid": "8b7e39c3-908a-4ec1-adbc-732f69193875", "comment": "Malware payload (44CaliberStealer)", "value": "64e2fe77e41166046e805ba1ef76f08b", "object_relation": "md5", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199006, "uuid": "b6661412-98f8-46c2-ae44-99020187565c", "comment": "Malware payload (44CaliberStealer)", "value": "a747a2f7264c60c28b052f122ef3d054390cb7514731ad14f401951cf2440b23", "object_relation": "sha256", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199006, "uuid": "b3591474-71e9-421a-b66d-0fc9f974a533", "comment": "Malware payload (44CaliberStealer)", "value": "50dfddd4cf4dfec24876dd4972f00e09025b5bc0", "object_relation": "sha1", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763199006, "uuid": "fa232511-b063-4da0-963d-27f77204bbc0", "comment": "Malware payload (44CaliberStealer)", "value": "991c42234df2336cbece25a504143008dbc260d95835e532c8b7d31e21148274d6f60299a3427b2530c01122ca202685", "object_relation": "sha3-384", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199006, "uuid": "0f6c69d7-c3b2-4075-bf21-9cffa16d12db", "value": "T11A64480817F88A65F5BE9BBDC0B551608371B466B83FDB4E1EC160EA2D32350CE49B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199006, "uuid": "d4bbcb5f-4770-4816-bfa3-9ca242f062ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199006, "uuid": "bde51ed4-ae07-46b9-8949-8cb570591b57", "value": "6144:Zb4T6MDdbICydeBrdcQG3yf51+/wJmA1D0feg:ZbGhcQG3yB1aI1Dpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763199006, "uuid": "43a0dbf1-7841-4183-9d75-f80f1e9e8e04", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763199006, "uuid": "999639b3-4435-48e7-8cb6-c54ca94152e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763199006, "uuid": "a39c289a-fad0-47a5-b98b-1f264ea1cdde", "value": "Krnl_69205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ed48e9-c222-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763211498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211498, "uuid": "127aae6d-8c03-4798-a281-fb746897d240", "comment": "Malware payload (Mirai)", "value": "0e2069768bb33ab8f4442a4918fa3baf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211498, "uuid": "c075a058-be09-4a7d-8651-765cb65fdd74", "comment": "Malware payload (Mirai)", "value": "a8d57354be7bacdb407fd88983437a4347b527c6a29db6bd5ef96f8d02f175af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211498, "uuid": "e09ea430-3b71-4988-a9e0-07ac7a8dee5a", "comment": "Malware payload (Mirai)", "value": "bab7e6ab41abe4897f68997faed5c1d34a99669d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211498, "uuid": "e63f991a-5b46-4970-af43-592a63959eb6", "comment": "Malware payload (Mirai)", "value": "25d4a5d8c95029255532befdb9b2fd26cb06baed53edd17caf11182a50e3730372a62166146b69c275eeec6b6348ff0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211498, "uuid": "9d15b46b-37ec-4128-b88c-736731df3d87", "value": "T1695302425B7CE43ACAE295390B7C41E786DC59A45493A00F53CD7CF84A05D68FFE8687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211498, "uuid": "fe5b928e-311a-4a5b-88bd-53eb981654c7", "value": "1536:Idcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/RnacBkAQ2:IaHJgMo8FwOA4zUFGUO3UhnacxQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763211498, "uuid": "73093013-55ec-43a2-bee0-1b8a0820c8e2", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763211498, "uuid": "c6f24ee6-8883-42fb-801c-8617b82f5971", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211498, "uuid": "24bfc73c-679c-4efe-bcd9-7c6128853e9d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3363bb6-c1ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763189193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189193, "uuid": "b5b8df2c-5eeb-4583-9b7c-465cbeb20db9", "comment": "Malware payload (Mirai)", "value": "b87b26d571f0ae65c3374296b353d0a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189193, "uuid": "107482d4-f6a4-4826-ac66-f689da82d393", "comment": "Malware payload (Mirai)", "value": "a9c220e6c662887db84e08e3d37411296ee5c9cf1ffe2ee5d6dd26a0f4deedd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189193, "uuid": "1bd43acc-9d54-4c1b-9964-67f902f9cfd1", "comment": "Malware payload (Mirai)", "value": "c8e2f3639e8003c015717196559bb77b5af2477f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189193, "uuid": "f62c4514-849d-4a9d-8cf2-c92ec4c42492", "comment": "Malware payload (Mirai)", "value": "77d0f2575053731be83cf8c5832e3ebe709b7822a1b3350d6adac14e053222e31d23dbbb7b0a70f68771f4fc6d54eee7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189193, "uuid": "65122315-098f-4e32-a138-a15df6c0ade0", "value": "T10E23F09ACCF2BBE1C1EE5CFEB0848A064C70F1D2FE5D0B59A33589C81928C57A59D4D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189193, "uuid": "662692b2-726c-4ad2-ab14-f0ba5ebdfb39", "value": "768:UVezeA5ZKRKsEuFbEHmDWiqV9k6o33C6zG8g73r0SU+FNKTQEW/Gy:2ezeFRlGHmylDSi6zGx73VfrKTyGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763189193, "uuid": "6f9c8f81-1055-49ca-9d87-5088c865aa22", "value": 48508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763189193, "uuid": "f81517ac-89cc-4d7b-ba9d-9a61f91e6c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189193, "uuid": "16b3d2ed-ea3a-4546-9d96-3be07fd6f78d", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d710ccd-c258-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763234522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234522, "uuid": "59994b74-54fc-4df5-b5be-915ac1d95798", "comment": "Malware payload", "value": "de17dad8ac298b678e4f9fe94f96df0b", "object_relation": "md5", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234522, "uuid": "6b29e92a-61a8-458e-bb63-73f283a71d47", "comment": "Malware payload", "value": "aac8e8b1b20c9b6199dac77d88fb4d696cb1f01f2000238dd9d367d9c6dbf936", "object_relation": "sha256", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234522, "uuid": "c1576c4d-0ce0-49e1-8495-1082c0633ebf", "comment": "Malware payload", "value": "7a8032de32555f202ab776fb2da1aea7a01b516b", "object_relation": "sha1", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234522, "uuid": "769fe4b4-6a29-477b-9717-e7a4699301b2", "comment": "Malware payload", "value": "c461ef567e9d5f07f1fd35b28b485a31a6429e28bd2586006ad5986c4c27893ec71f60b8095b8030d738f1e9ca2bd8cb", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234522, "uuid": "f5d768dc-9e3f-4960-8ff5-09cd75635f82", "value": "T1BBE423258EB114BEE213C17EE49717713AF13B613372EE99119095FA083B25B218B67F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234522, "uuid": "21880849-205d-4d5b-a55f-f3bb3ad3870c", "value": "22611ae1c181bb107345c700d21127a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234522, "uuid": "e11ab76f-543e-4c24-bbfa-aab9e75c1477", "value": "12288:WkqjVnl36ud0zR/6CtQ9PUHIG8DPqyC8CD3agb88wWn+ah0xPKd2bKRy:WkqjVnlqud+/2P+A8TDqgb88wWnVWxtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763234522, "uuid": "56bfd280-8c7c-49a4-a602-7560354388d4", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763234522, "uuid": "d47c6953-fb56-46e7-81fb-92f3f5e86d47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234522, "uuid": "4b91c3c2-c790-4e16-9fc1-519681b12f8e", "value": "FileSyncFALWB_x5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572fd72e-c23b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763222057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763222057, "uuid": "5e9eb27c-508e-466f-952b-7f9a6ea4fba0", "comment": "Malware payload", "value": "94f36717c4a39d133828b7592a1ffdfa", "object_relation": "md5", "Tag": [ { "name": "NetworkReferences.Malware.Generic", "colour": "#C60C00", "exportable": true, "hide_tag": false }, { "name": "PowerShell.DownLoader", "colour": "#A08620", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader/PS.Agent", "colour": "#D08728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763222057, "uuid": "cddd723c-a062-4a07-aa65-2e8351aa2442", "comment": "Malware payload", "value": "ab189d33e17b87f6181e2ccbbaa4272bc7b8eb15635187810ab94bc648ffad84", "object_relation": "sha256", "Tag": [ { "name": "NetworkReferences.Malware.Generic", "colour": "#C60C00", "exportable": true, "hide_tag": false }, { "name": "PowerShell.DownLoader", "colour": "#A08620", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader/PS.Agent", "colour": "#D08728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763222057, "uuid": "17c8cd65-0a0e-462d-b88d-14f23f15d765", "comment": "Malware payload", "value": "230e189379f43ae2c0633cc482fd9c18859b4975", "object_relation": "sha1", "Tag": [ { "name": "NetworkReferences.Malware.Generic", "colour": "#C60C00", "exportable": true, "hide_tag": false }, { "name": "PowerShell.DownLoader", "colour": "#A08620", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader/PS.Agent", "colour": "#D08728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763222057, "uuid": "7ab539a8-5d27-4fa2-a53d-1aeeedc68d45", "comment": "Malware payload", "value": "a824da3abcbe49c8d415410228246f5b734427e1f0f82cf2c10513af8d463dd80b0d4a947a8daa6e4371baf95755fcc2", "object_relation": "sha3-384", "Tag": [ { "name": "NetworkReferences.Malware.Generic", "colour": "#C60C00", "exportable": true, "hide_tag": false }, { "name": "PowerShell.DownLoader", "colour": "#A08620", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader/PS.Agent", "colour": "#D08728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763222057, "uuid": "4875e15c-0930-4f7d-ac2e-74909569d391", "value": "T1F421727707562F68DEC62160BC09ED59526E8B1B42463D2822CC7A06F290FFC01ED7DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763222057, "uuid": "af4b7320-982e-48c7-b366-b89d41ee940d", "value": "24:qtyLwhT1mLqhN2KkmU4dQc82x9sHaeGpgJ4dQX02x9sHEG/u:qddZhN7kmFnTsHaeGpgG6tTsHEG/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763222057, "uuid": "e25c17fa-5895-44a5-b9da-2a3d53daeb3a", "value": 1291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763222057, "uuid": "05b6a873-0021-4bba-a5a0-7b0342f6d2d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763222057, "uuid": "647ccb07-ae09-4c73-86e3-bf0f4502b2aa", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cb3569-c259-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763234907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234907, "uuid": "1e7522c8-09f6-45b2-ae2b-287ccc1bae3b", "comment": "Malware payload (Mirai)", "value": "25404271e0341a4fcfb454e51f3a39f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234907, "uuid": "15e1dfbc-22a6-433c-a300-4e7a6e8f38c2", "comment": "Malware payload (Mirai)", "value": "ac609c96efc697475b8153ba65dfe15f87a7c71f75f257dc4217523d60e5bc7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234907, "uuid": "f44be07f-3adc-465e-bcdf-289a453e6472", "comment": "Malware payload (Mirai)", "value": "7a3ff61d1188dc9c18b81cd984711c81a723e646", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234907, "uuid": "add27ccb-2de8-4a92-8c15-9a1f82179907", "comment": "Malware payload (Mirai)", "value": "91569ddbefc49c71c1df72fe7593df6f861e47c1949b7fd36d13707849a8a1196b63a5e6f9b79185a501308d2305c944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234907, "uuid": "9fc9c876-3295-4701-9d3a-3d9b4982e3e4", "value": "T12D043906B5C8C0FDC496D1784BBEB136D971BC5D123CB25B2788AE222E4FEA05B6C651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234907, "uuid": "b8b3827d-2df4-41c9-be09-9113e1cd13e9", "value": "3072:RBK6IuFhNb4L2E6xVp6a6i7+rmgUmwGksBsEav3PEt4i:RBKSNUf669wvsyct4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763234907, "uuid": "18b59e38-27a3-41cd-9825-871f33703cc0", "value": 177064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763234907, "uuid": "01e43921-2d10-448b-b94d-20c24d1e1a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234907, "uuid": "e63fc88a-8fe6-4a49-849a-459a0614cbe1", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739456f0-c1ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763175289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175289, "uuid": "5ae56a22-23c4-4c62-b98f-ba3eae04b9a8", "comment": "Malware payload", "value": "163ada9d228fc558d92bdf4ceec9abac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175289, "uuid": "1e7fa299-b504-48b5-9b5e-ccbd985e6d3a", "comment": "Malware payload", "value": "ae6032d23e295ebc3c8a931aad753c5284290907f1bf1ff28db061d464a3f43b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175289, "uuid": "b97af085-c044-4c65-b31b-e74671ec0fb4", "comment": "Malware payload", "value": "bceb3828beb0cf0287958b443b292fbcec6caa55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175289, "uuid": "9e1b2b6e-9fcc-406a-8389-99138f96cc1b", "comment": "Malware payload", "value": "4a7ceac8c624214b902cc0c6b932d2fbc6d8aab30fe33873e670b068d38bb339892fd6a63ee052ad421e82f544ecfc88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175289, "uuid": "a9e42f93-e238-4876-b587-a5b9685c0ff0", "value": "T1CBE63357B66108FBDBF3D139C31AC2B9E42234164B22D68F5AA401135E637F29E7AF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175289, "uuid": "e99d3a43-5998-4828-b12e-780cbd08d89f", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175289, "uuid": "ccbeeeff-1f4e-4222-b4f7-a2a1526c0985", "value": "393216:jqYuwq3Obs2ClJ1+TtIiFquuARuAEq6EcDrb:Duwq3ObRqJ1QtI1uuAUXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763175289, "uuid": "0c7de9a1-eeda-4a43-b6c6-1e0f8445d50d", "value": 14673741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763175289, "uuid": "83571ad2-17d9-4316-bef7-f46bbd748aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175289, "uuid": "4ffebb86-972d-4031-bcce-3179acb15862", "value": "client", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9ccd5d-c227-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763213534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213534, "uuid": "4ad3b1e4-9e0a-4d29-806d-93a01eb39578", "comment": "Malware payload", "value": "53a2401f3658dc7b06e919924d2e12b2", "object_relation": "md5", "Tag": [ { "name": "John", "colour": "#BDC3AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213534, "uuid": "27218d68-9578-4cdc-958c-9c89c4a0c1ce", "comment": "Malware payload", "value": "af2a278c76aeb3702c73db10b7081de8e18ca6518c3a2c78a20394f0df9a3359", "object_relation": "sha256", "Tag": [ { "name": "John", "colour": "#BDC3AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213534, "uuid": "b03bd0bb-3419-4178-a142-e1cb64d13eed", "comment": "Malware payload", "value": "1864f060dfa5eeeaeee3725ae9baf01fc106f1da", "object_relation": "sha1", "Tag": [ { "name": "John", "colour": "#BDC3AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763213534, "uuid": "b5b7713c-4cd1-4a64-ac6d-496ded74077c", "comment": "Malware payload", "value": "d076b70720ce2dff28a6252f7e0b96c7c5fdb105ccad617832ed66c5682dc84e77e3c08c9731b60d6b1bcb7e13da9190", "object_relation": "sha3-384", "Tag": [ { "name": "John", "colour": "#BDC3AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213534, "uuid": "a14954d5-904a-40d4-bf61-84f56a2a8af2", "value": "T1C091A61FFE92D66AC503922CEE967805FA27908B91581940F6EC94481FA64380BF9FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213534, "uuid": "2830a544-e510-4203-b1ad-e5297d91d363", "value": "96:gy5+I25vo75jXPeIFucC2wy0V6no5jV+z7c0d+/7Wr0xLS:gy5+9vocaucNwy0V6y+Ui+/7Wr0xLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763213534, "uuid": "4ba4ba0a-9a48-483b-8de0-8e6f174c6f11", "value": 4315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763213534, "uuid": "ccd5a649-ab87-4afc-ac19-146d5023787c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763213534, "uuid": "fce8736f-6181-4027-bf1b-12cb6561aafe", "value": "john_764_ransomware.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5197aa7b-c249-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763228060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228060, "uuid": "52bd3c65-294a-4079-9710-919105669520", "comment": "Malware payload (Mirai)", "value": "66cdeb308835901bc7445dcb5bfb964a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228060, "uuid": "2e447d25-6a0b-43bd-b33d-981e11106594", "comment": "Malware payload (Mirai)", "value": "af74aa325aa99b512eb7bae3f8fe08cbf0d14e68d0dc0bbd588b6a011d38aaef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228060, "uuid": "a908f14e-cb08-4a89-a54f-6d303af79a61", "comment": "Malware payload (Mirai)", "value": "2598865ea7b85c6b4e6bfbf362f78443b6eccc9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228060, "uuid": "68787e5a-4e7c-48f4-88fc-df75920b61de", "comment": "Malware payload (Mirai)", "value": "db8e73023ff5f637a6bc300c95c32cbcf8931f9ff6615d84ff1f07113759050df39b6529bfa609f526283965f0e9fd1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228060, "uuid": "84e836c4-2747-4740-acde-0221ee15dc7f", "value": "T11A831882F8828B2AC6D013BAE6AF658E3361B7E5D2DF7517CD244B113B8110F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228060, "uuid": "aa2946e9-cd37-44dc-9ff8-f6520cb43330", "value": "1536:PTVc34IqqYy2ywSaM80n7dbrgqXmI7pOYfAWKNDbf8nnYVXd:PTVxIqqYy2HSa+IcGNf8Y1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763228060, "uuid": "e2f8380e-2ce5-43a9-8dfe-6f3c1ec5dcae", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763228060, "uuid": "8e156c76-bd22-42d8-b143-331c5ddd323e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228060, "uuid": "0f032be0-0ac5-4879-a8b8-c71878e69b21", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47860ece-c204-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763198408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198408, "uuid": "9061ad43-c448-49ee-b461-113330a425f1", "comment": "Malware payload (QuasarRAT)", "value": "8fabbf87b27577939013d86df2604a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198408, "uuid": "705af643-c590-461c-ac9c-488d47828a4d", "comment": "Malware payload (QuasarRAT)", "value": "af9c255e0ddd0fc5952840efca25a1e103c3e25d5d6cb1a4361dbd2d61c512cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198408, "uuid": "31b87072-d3ae-434c-b96f-76b26b69f8c2", "comment": "Malware payload (QuasarRAT)", "value": "c0fc38b04b779ce02fdab792a43460348f816982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198408, "uuid": "775ec587-f621-4974-add6-212df528cc24", "comment": "Malware payload (QuasarRAT)", "value": "e3b41723405cc5dce81545ffb6614c1c2864d5745eef9796223ea4b6a2cfcb9385232dd548fbcb046981170901fc47f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198408, "uuid": "e36263e7-2bcb-4ef8-86a8-5a5abd03cf4c", "value": "T1B0E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198408, "uuid": "c90c6146-0cc9-4c17-b7d8-6f3cd5f50a42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198408, "uuid": "4042d3e9-dc45-4e8e-8d6c-3fe0449fd2b8", "value": "49152:dvDlL26AaNeWgPhlmVqvMQ7XSKBSRJ65bR3LoGdSRTHHB72eh2NT:dv5L26AaNeWgPhlmVqkQ7XSKBSRJ67i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763198408, "uuid": "6f3d2943-dec2-4d2f-98d8-c1145537259d", "value": 3270656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763198408, "uuid": "fd8cda5f-78f6-44db-8650-5e3878ca2608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198408, "uuid": "b6f16858-c9ec-486b-bcfa-5e865872be7e", "value": "ClicktoBuildIunosShrine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c266a191-c24b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763229108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229108, "uuid": "b6914f35-a1e0-485e-8f3b-dc7f65d1a9de", "comment": "Malware payload (Mirai)", "value": "7aac2a7a293394bea67d6ae4c1a02047", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229108, "uuid": "a2ded62b-535f-4b4c-b038-91242f7a47a2", "comment": "Malware payload (Mirai)", "value": "afb7e22f48b5391ea93352b13ba633a3c412b33e7571379f4d35c079abf27f70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229108, "uuid": "7267cb7d-e005-43c5-bea4-c0a0299f889c", "comment": "Malware payload (Mirai)", "value": "c26a945f37014505ac1c04f077591101c0aa1ee4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229108, "uuid": "188f8d4a-f9e0-4d95-8fd0-4830483f6ef0", "comment": "Malware payload (Mirai)", "value": "a5ff7bec97cfe2c4ee8cc1f6af4c9204eaf85326c6e3289b98a6599d84825d6d5b7b585e0c5a9793d02172ceef25bb22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229108, "uuid": "1b96f807-2fdf-4211-bd66-79d44008b45c", "value": "T119F34A02731C0807D1572EF12A3F77E193EFD5A120E8F645654FAA8A9272E72254AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229108, "uuid": "6091f724-f8af-4c2d-93ed-54eecf1ac7a1", "value": "1536:k4kirVCdUl8riIHopNGawHZYWixCZxDHOg9ujOIfHjQs8bWX4UkvAih0KaG+21rv:Lkir/iippNGE0ZxanxHjH8iN5i/o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229108, "uuid": "b5c220ff-4afe-4cc0-aaff-2a151b56d0ac", "value": 171256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229108, "uuid": "feba785f-260c-42b2-ae0a-832126cfd065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229108, "uuid": "a3a3ce5f-3dbe-4d12-b3dc-16e2ff07acdd", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93609da-c1d1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763176694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763176694, "uuid": "8af5b1ee-0ed1-4f9c-b879-a60e72d974b8", "comment": "Malware payload", "value": "650fcbfbdf96f0d491f1fee72817563f", "object_relation": "md5", "Tag": [ { "name": "hacktivist", "colour": "#189C18", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763176694, "uuid": "3b4ff4a7-104f-4860-b7a7-c87a6271d4c2", "comment": "Malware payload", "value": "afebe260907b09bb39dd1764ff2c0be5dcdf46a175011145dd6e9947a1c9bbe8", "object_relation": "sha256", "Tag": [ { "name": "hacktivist", "colour": "#189C18", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763176694, "uuid": "a5e4451e-f5ad-4553-8037-f7e0a2e339d3", "comment": "Malware payload", "value": "f1c57d4dfa69eab40227cc72ec043379aa19f9c3", "object_relation": "sha1", "Tag": [ { "name": "hacktivist", "colour": "#189C18", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763176694, "uuid": "cac3498b-bf8e-44e9-83d5-3f7586db418f", "comment": "Malware payload", "value": "136c3d725103c7d270dd8971461f8a6e5d0a49f0b0d955864829b1ef0b16e40adc9d2dff87b3e258e4e9bb7086aa0469", "object_relation": "sha3-384", "Tag": [ { "name": "hacktivist", "colour": "#189C18", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763176694, "uuid": "1a168e4a-f01e-4e27-b2f0-00e982cedfa9", "value": "T1EB03CF634EA9E3613B7E85E42677B7DD2F827E9CD824A87B09A22DDA33704C1814D41C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763176694, "uuid": "b4777efd-5525-4a38-80a7-281e789878d3", "value": "768:Lz/q9EJr/nckgqyUAWuf+1gNZwi2N1fWjeIGvr+30sfjBW:LuAn+UAPf+1uZwfjwe7a30sfjBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763176694, "uuid": "11f783d0-9fae-42f9-bd87-7826cf5c6fdb", "value": 40450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763176694, "uuid": "fd467f23-904a-4446-a688-452a035b6cbb", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763176694, "uuid": "1c55044b-aff3-48ac-b3d5-050b560f0dd7", "value": "paku.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcc6903-c1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763175789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175789, "uuid": "a8d35331-8c2c-4cdb-82d0-b4b23f76cf1b", "comment": "Malware payload (Mirai)", "value": "0107fe6969a797c97879b979730c3538", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175789, "uuid": "700c21b8-d563-4e1b-98ef-5d6ceea3871a", "comment": "Malware payload (Mirai)", "value": "b06280bc91a04be19515aa371e820768097b4669c85d9d4c274b89af07c528ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175789, "uuid": "6fddcec0-cf51-4438-a3cd-893e4adc4547", "comment": "Malware payload (Mirai)", "value": "ed0a9c3047a84ebd5b61f458eec28d5cae694f3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763175789, "uuid": "dd8fc56a-579d-41db-b922-eaf91879872b", "comment": "Malware payload (Mirai)", "value": "da5a66250c2b2995a5e5b08a812a381680efd6f354de580e969058c440018094250b0039993b0fcc4b516048a88d8347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175789, "uuid": "3f22089b-3258-45ec-80dd-15469d5a7949", "value": "T1C4A34A137981DDFEC497D2F447EFA5269921F82E1A35729E63E0BEA22E09DD0671C310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175789, "uuid": "7218021c-231b-433d-a639-35792ad11988", "value": "3072:VS4ymfUQOfa88O8RLowTjgOqsN4WAuPvx4eHbX4dD8sBuyqJt7DDA90:VS4zfU+DjgOqsN4Ngvxtj4dwxfs90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763175789, "uuid": "e3759d17-f42b-492a-88f4-b1445ea5b180", "value": 102896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763175789, "uuid": "990ae12c-2bec-4b00-b557-ec236f41d2d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763175789, "uuid": "79f9621b-e08e-4d9e-b67a-64f1a49b81d9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b02d86-c1bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763168666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168666, "uuid": "11096bd7-37ba-4f37-9826-c3441b86dba9", "comment": "Malware payload (Mirai)", "value": "e5d1791d4643f34255ce467b925024cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168666, "uuid": "998a154d-8eeb-42ed-b3c7-d80439e0cefd", "comment": "Malware payload (Mirai)", "value": "b0d85229e8d9eba3defe370690612413c9370b93fa7faee602c4c0d0692873ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168666, "uuid": "0516b205-20a3-4f7d-bcea-22526a400a05", "comment": "Malware payload (Mirai)", "value": "5c0ec69ebd4a146d1dff23c6a1f3e1e49de9e34a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168666, "uuid": "a914629f-aecb-4027-a0fb-3d1609173f0f", "comment": "Malware payload (Mirai)", "value": "ea0cbbe2fd2f41883abd207c4bb05b0fdd7a1bbdc9133edbffe6fececb117a6385e04f69f4feaa596d891b47c5c7da6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168666, "uuid": "222c6044-7d08-48ca-9f31-986eed00c772", "value": "T1CE731992B8C24B7BC6D013FAA76E268E336163E1E2CE3127DD655B1137C520B8D67E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168666, "uuid": "0c421abd-4e86-4d17-993a-246889738d6b", "value": "1536:rsUQmNAPtnHKTsnGKaUOUSyT77/PAHFsLmWb:rsTmNAP1PLA6LDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763168666, "uuid": "5131ca5d-ec9f-4f70-bde1-9aa0bb18ac36", "value": 75200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763168666, "uuid": "2e639a17-a2af-4dfc-b56f-e586aed588be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168666, "uuid": "7b86277b-eaea-4c4b-9618-73ae4b928193", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a4ab06-c1be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763168335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168335, "uuid": "82b46717-82a2-4a25-bb2d-661df1255a14", "comment": "Malware payload (Mirai)", "value": "e9bc5ac84611ca86f2006fafd6035dec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168335, "uuid": "4024061a-7381-44c4-b688-44b87b25e9a8", "comment": "Malware payload (Mirai)", "value": "b2a83234ec9a15c605299e5dbbe73d0c4d7c19ee4c0e98874a409e5a913c6076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168335, "uuid": "5527ded8-19e2-4160-9734-80c71734c8f9", "comment": "Malware payload (Mirai)", "value": "4adc3d9210db98a3601a788b553d8e704e864d89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763168335, "uuid": "b54172a0-d464-47b9-92a2-5c3410ccd9bb", "comment": "Malware payload (Mirai)", "value": "cbce92893464cd76305553eee048c63b597cb0044beb029174e59322a4e357941b4084a24a10c40e8bfde7b42eeab4d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168335, "uuid": "2c1a627c-8921-4cc0-a181-4f041b82c655", "value": "T1FAB34BCAB802DD7CF80FDEB6482B0D0EB970939156831F26635BFD93AD721A17852D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168335, "uuid": "db11be11-02b5-4e0b-af94-5984d011490d", "value": "3072:uciU6vthWkteA53O6MNDQdNTQt6icI+GP:FX6vthdrKDiN/ickP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763168335, "uuid": "3d6f0a3f-7a2b-4c28-911d-bfd8cb0431f7", "value": 113780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763168335, "uuid": "0d248700-2419-4d1a-a011-68fcb2b70b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763168335, "uuid": "d1301c60-1a29-4899-bd9c-a8306691d1cc", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6358a563-c1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763166242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166242, "uuid": "4c49caf4-0fe5-4376-a021-17c1f2932065", "comment": "Malware payload (Mirai)", "value": "3f1a039f1cce59ce7f796a39822c1f0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166242, "uuid": "efc14582-7eb1-4cea-9690-ae5ebf9ed846", "comment": "Malware payload (Mirai)", "value": "b3a5cc60ae8b317d31ff0b53366f891222a66e7c4c5803e72690d94e405d2e50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166242, "uuid": "76a3611e-3028-4d71-a53c-acc919b0a768", "comment": "Malware payload (Mirai)", "value": "1c9cacdd1a1344f8410680cd46202e7749c573bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166242, "uuid": "57e5d461-7493-4cf7-8013-00bcf330a051", "comment": "Malware payload (Mirai)", "value": "699aef9b6dcbe845c46a4fff2ce22a2bbe78fbd59176d2e8494cf77d988baa680bd39e7dcb9efba8f33927abebb74d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166242, "uuid": "645f8085-e618-41ec-919d-2879057b3b20", "value": "T1F3F2F14C19C86D21DE651AB4CC19A7C4C1A64F3A123D347397987C76A6C325F36FA2E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166242, "uuid": "75b15f8b-02b2-4926-aa9f-daa9816f8c57", "value": "768:R4MjIstNvZ0AZPMcBhtc/ikD/vTbBJQfwn/iyb0J5lG7SDN2RHFo3UWt:RTHNx0AtMItYfD/L/9n/i+0E7S5+8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763166242, "uuid": "eb89c5a2-7989-43ef-8f84-a0c2f0f5f989", "value": 37348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763166242, "uuid": "8ba0286a-fb75-4a4b-a569-82140d733a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166242, "uuid": "135d6176-13f2-4241-a582-8c42e178fde0", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae9dc65-c237-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763220345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220345, "uuid": "1f494c23-f95b-4a15-828c-dca7ad588127", "comment": "Malware payload (ACRStealer)", "value": "ea60debf2b41494d4d934e28c67a5b4d", "object_relation": "md5", "Tag": [ { "name": "5-78-157-244", "colour": "#9FCDC7", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220345, "uuid": "958e5805-707e-4811-87c7-97edaa8fe7b2", "comment": "Malware payload (ACRStealer)", "value": "b3eb672db39a6052c89dbbdd1292e68c37002ebebabd00c32bdc08e085ecba6b", "object_relation": "sha256", "Tag": [ { "name": "5-78-157-244", "colour": "#9FCDC7", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220345, "uuid": "6e17c530-4159-494e-97b7-7a5b1d8431b4", "comment": "Malware payload (ACRStealer)", "value": "c475f2733844564be84cbd4ce6a63a6a964d69ac", "object_relation": "sha1", "Tag": [ { "name": "5-78-157-244", "colour": "#9FCDC7", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220345, "uuid": "de04f849-707e-4a90-a036-4ae8ae4d836b", "comment": "Malware payload (ACRStealer)", "value": "20d4a31190986ab136b1652a496326709331eca1ee5dbbb85737b55c5c8d4e02b5ebeab75b6841addac5244d65a32876", "object_relation": "sha3-384", "Tag": [ { "name": "5-78-157-244", "colour": "#9FCDC7", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220345, "uuid": "9c1a38b2-9f52-44a5-bad6-f8dabf43decd", "value": "T13F37336D8EF0D5F9DF5C9B37219D1AFC6265EA7298EB470F285581D088D0B8112EC0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220345, "uuid": "c5b8230e-321c-4d20-9ac8-a2ea7cbd0190", "value": "393216:Bsqgtba1eRK7V/l0bld5AlA1DOMzrIspUEYZFXkrKvHjl7/uiv3PGTWVypAiLzHE:qqgjw74ldqlCzrIspUHZMOHjlzPGKEAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220345, "uuid": "ca37814b-c897-4b97-93b2-3b5d56e40f39", "value": 22436840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220345, "uuid": "61454435-95dd-4b0e-ae89-854eaf752130", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220345, "uuid": "19f7f5d0-73d2-414f-8585-92554bad3785", "value": "Setup_1763209884978.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93a6e80-c22a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763214946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763214946, "uuid": "80c148a4-d928-49ea-8f23-eccd8a9029c7", "comment": "Malware payload (Mirai)", "value": "7e85e665d3a510298b8d477c42e69b6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763214946, "uuid": "73761ef3-c31a-4c57-a284-14ee4fdb6fb4", "comment": "Malware payload (Mirai)", "value": "b45801d1c9bb5d31913f3c6d1bd83db4412014dd13b9f2e81719422e1d1b9ec1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763214946, "uuid": "201337da-28d4-4ba7-b7ce-49f9362be3ee", "comment": "Malware payload (Mirai)", "value": "f3ea3d87c57fe86de4b0fa3421d4930ecb61ed6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763214946, "uuid": "9d66f8ba-d314-400d-b329-ab08011fa92b", "comment": "Malware payload (Mirai)", "value": "d0d5eec1592331acaa5b4565efd5c645d937c5cd7b9a0a1851e2cb2071cae1464449aac75a6dde66caecbbbcd868ac19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763214946, "uuid": "4f3afef8-25cb-438a-a10d-3f24ff8b0cd7", "value": "T16A73127221A7DDA2E671803263437D597D23887A0374A3BEBD79972EF447E10580C95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763214946, "uuid": "11616da9-6547-43ac-9c09-c7095df934b0", "value": "1536:n8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmP5ForS:8zRnwP0bMQ2RijvDZZ1rYGhG13fSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763214946, "uuid": "16cc9c2d-ff10-4d2a-829a-7cc784f81634", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763214946, "uuid": "a9597cab-6f17-40d1-8ac2-1fe602d19441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763214946, "uuid": "730f89d5-7b33-4731-8892-9ee7cab3a9ae", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8beff7-c238-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763220962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220962, "uuid": "b5bceb5a-00a9-46f9-80e5-4a4b10874dab", "comment": "Malware payload", "value": "7849deacd5053ca73a19b862d41a0672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220962, "uuid": "40169f5e-50bc-483e-8155-28c7e9b5ee20", "comment": "Malware payload", "value": "b539277cbb497925b48b82c09330569169286e9a73eb82d9c84fa16c7926b5e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220962, "uuid": "1566253b-2d92-4db7-9b2c-0126149739cc", "comment": "Malware payload", "value": "ff31fd352344d1b6007280168ba06ef31b7c49a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220962, "uuid": "cd624bcd-6bc4-40bd-abf3-21721bfe8ffd", "comment": "Malware payload", "value": "6b991a67c302c45496dda03c256dabf293407fbb0872b13b516b16d053129cebf3817f663e23eb404d6eee09399d4d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220962, "uuid": "121c41c3-16d3-4176-bd48-aa39c6aba61d", "value": "T15AC34B237555A4FDD51AC0B883018AA35B75B8DA0F2267FF029551382F6EAF63F3CA14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220962, "uuid": "398667c2-5a7d-4bab-9122-53e53a9b96ab", "value": "57be01759f56dfe10028fa079435ee04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220962, "uuid": "0a80982b-e1dd-48a6-a960-27410bb55f93", "value": "1536:qbplVk/kvZ8udZH56C9RmmaucEux9eVNCHcWTgo2ttJWRlc1MaAbmSXUSAQM6wXX:SpssvXLHH9JgDc8gPaaUbmSjwiFu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220962, "uuid": "6e6807ee-8207-4bb2-ba49-0a328d82027c", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220962, "uuid": "4fea4868-0072-43fa-a1cb-d3c355f6a50d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220962, "uuid": "466e188a-3cbd-41d2-8033-e9b01aa9810d", "value": "uninstall-service (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8d0d48-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230813, "uuid": "4b87bc4e-b4b4-4f9b-93d1-369c253ba098", "comment": "Malware payload", "value": "32a8a530f970cbeeeb3b2231bf645947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230813, "uuid": "8d09d77a-6e84-48e0-9302-3392bd80e213", "comment": "Malware payload", "value": "b731f58435d0c90c90fe817b17a13e4f3eb9683da6630edf435ef97d5e762b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230813, "uuid": "8b1ffdb2-b014-448b-b482-880cf6ca5c80", "comment": "Malware payload", "value": "acc3cad52665de33e6b3977f7822ddd09614de5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230813, "uuid": "875d9353-9ec2-451a-8776-01e89427d7f1", "comment": "Malware payload", "value": "401d62754670b31bb2ba7e2238387145d6af1ce1ce8a5f34576c13c17b3887572fb58eca8b17bb97cc00b242aedcfc96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230813, "uuid": "936ab14a-2432-4cde-b176-961cd42e9773", "value": "T1E6B5AF65ABB420F8D96BC138C9734517EAF2F4561360A7CF07A0C6661F237E19A3A3D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230813, "uuid": "d8ee2835-8db7-4400-b757-77ba1109f3a3", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230813, "uuid": "98b0cf75-abcc-4c42-9369-bf08ef9a32de", "value": "49152:pq8CnibSgAaxNQ0idSktc1OucTAVH20vDT:pPvzAaxNQ0idSkn8VH20vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230813, "uuid": "a6a3166a-a810-4c6b-ac93-1f5723167a51", "value": 2317591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230813, "uuid": "f28b78f0-7249-40be-afbb-0cb091a138ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230813, "uuid": "5ec52e9c-8859-4c89-bce0-821858e335ba", "value": "sdfsd64a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b41d929-c204-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763198307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198307, "uuid": "df9e2ce9-66a9-45da-a65e-74ea99e0fd18", "comment": "Malware payload (Mirai)", "value": "277597966a7055d7ea8f1c6348381ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198307, "uuid": "de8d8145-b099-490a-a6d2-bed886b03961", "comment": "Malware payload (Mirai)", "value": "b975d319734324bbdddd1561542a5886aae52d7c86f8375c28d5fc2d67df1662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198307, "uuid": "ae3b1142-af3f-4419-a2d0-8676a65dd603", "comment": "Malware payload (Mirai)", "value": "7b9e9acc1e7ed70fa9abfd189226de1c54452ca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198307, "uuid": "c91c3cbe-c0d3-4480-a735-aa591a2b29bd", "comment": "Malware payload (Mirai)", "value": "f890621c9874736bd65face1238cf97ca6e40c44cafea2d4db9e312b9aa73f0603ba05eaa943ad78d05b5fa9546802ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198307, "uuid": "8251a965-e609-4549-8886-4b0d60b51c04", "value": "T18963F886B891CA56C5D952BAFA1E11CD331317B8E2DF7313DD105F647B8A82B0E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198307, "uuid": "3b5334b9-96bc-4a46-83be-643f84d548d0", "value": "1536:CxnTjXjKKBAQjuPUV/KqlsOaSoOJP2r5cbItfe32MqEirUsRdiMuybVR:2zhB8PUV//uXO2BUsRdiMuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763198307, "uuid": "78e8e542-7e3e-42a9-83dd-432457bce795", "value": 71612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763198307, "uuid": "3928f290-897a-41ef-9691-6b005259b741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198307, "uuid": "70094e12-d738-4473-a17d-3b0954ce6121", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72591fdd-c204-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763198480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198480, "uuid": "ffef157d-eae2-483f-8e29-a4a52ed79698", "comment": "Malware payload (Stealc)", "value": "124ed0454b5354b2e56e68adae093e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198480, "uuid": "f88be958-1214-44a1-be66-118af2b298cb", "comment": "Malware payload (Stealc)", "value": "b98b53ca03e3e9009b31bcc37b90b206064b25effce449dde63c51cef6a47470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198480, "uuid": "6283afda-e11f-490e-8dc3-5a2908d6c54f", "comment": "Malware payload (Stealc)", "value": "1437cf9a986f689902f3e2f536fe34e3807666f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763198480, "uuid": "02e0b6ff-d1e6-4177-ade3-f2810d69ff8f", "comment": "Malware payload (Stealc)", "value": "b8c9307ee6e4683fbbeeff1d1f72af1d074934b385bf47d4a32e76d39d8dcd6ab0d6f7acc64767276e3e21e60ee2bffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198480, "uuid": "1a4457ab-f297-4cf9-a17d-53ed82019c24", "value": "T10FD3495B73FA30F8D077853985920A45F772B8765B606BEF07A442661F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198480, "uuid": "453095d5-2571-48d0-88c9-1063c28f23fd", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198480, "uuid": "d5eade66-4e1a-40d9-9cb3-dcf17bbf28d9", "value": "3072:XR0D/xeYNiBykTp34/BPA4y7rpqx2JAZGcHWDv2:+D4Y/kTpmxy71rxv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763198480, "uuid": "dea84dff-3b34-4402-830c-8331c7a0b2ef", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763198480, "uuid": "7a68e428-d04b-4fec-9da0-6cf1d60d30ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763198480, "uuid": "668a1a74-7fae-4681-b167-0ffe3715dfcb", "value": "Aero.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bc7b60-c201-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763197323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197323, "uuid": "acdd5796-3933-4d8f-a0c6-4d913df69764", "comment": "Malware payload", "value": "75f56c53938c7520b2b784170d555d82", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PowerShell/Disabler", "colour": "#04D444", "exportable": true, "hide_tag": false }, { "name": "trojan.pantera/disabler", "colour": "#4362F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197323, "uuid": "21954697-4bf0-441e-a6bb-a90e5b6e9385", "comment": "Malware payload", "value": "b9db41973528118cf9b8fba38b314afa82fdac1bc1d7717c05c69e8188af06c2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PowerShell/Disabler", "colour": "#04D444", "exportable": true, "hide_tag": false }, { "name": "trojan.pantera/disabler", "colour": "#4362F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197323, "uuid": "b41d0acf-cb28-46ae-b63c-c7b7f1168558", "comment": "Malware payload", "value": "b062e4d8eeb2c61dcf0534e1384632a7e0a8b712", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PowerShell/Disabler", "colour": "#04D444", "exportable": true, "hide_tag": false }, { "name": "trojan.pantera/disabler", "colour": "#4362F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197323, "uuid": "37c12334-c710-436c-bd5a-b77456635c77", "comment": "Malware payload", "value": "6e4f5c3279ffd032515d0fee95a94d0f8209e503b129f91bab0a5d90c60194a2e4ec90ea421c9e35db6e9cc2d8bbf29e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PowerShell/Disabler", "colour": "#04D444", "exportable": true, "hide_tag": false }, { "name": "trojan.pantera/disabler", "colour": "#4362F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197323, "uuid": "dcfda3fc-387e-4959-8559-7317979006e9", "value": "T197316C252017C382EA31A690D20B1E4BE35FC86F21AE0763616E405BF443D83B3BE6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197323, "uuid": "b1d64d25-bea8-4f50-b71f-a4dee232f61f", "value": "48:N6HvPFCkixfh7euBVJg2VHg2Vkg2Vsg2VNgGDaQ5:N+P8xdT6yH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763197323, "uuid": "c9c6a8a3-5b17-4da0-9364-f1a7659f45a6", "value": 1721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763197323, "uuid": "b3adb86b-e325-405a-b7cf-fb3b5ae2714b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197323, "uuid": "e79050e2-c12a-4345-ad9f-d93ee62793d1", "value": "MapInfoR.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d357d6c2-c219-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763207662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763207662, "uuid": "849f2fa6-bb06-4937-b343-cd3192c7d78b", "comment": "Malware payload (Mirai)", "value": "f7365c36fd1388561f076d6d16ab2316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763207662, "uuid": "1fe05fe4-570a-418f-9763-60936c582972", "comment": "Malware payload (Mirai)", "value": "badb2d9863edde0ec0af9d7a4139aca52713540f53408decff2f0a6ef6209d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763207662, "uuid": "8599ad9d-89ed-45e0-984e-90cebadb1023", "comment": "Malware payload (Mirai)", "value": "c927898b2d37bba9a07a5e343ec24b6635380329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763207662, "uuid": "d0dcc2b7-bc24-4346-8fc3-e090d036f775", "comment": "Malware payload (Mirai)", "value": "506e29494f69971cb68d78c5f8ce44b3901bd285bf87579ea5768e315441ddb7467cdd81655dfb86e2c45b7d6040a113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763207662, "uuid": "b8d23f11-f078-47d7-92f7-f2874a791f41", "value": "T1FF338DB6C42EAD94C54852B4A8368A756B53E100C7923FFB9E45C5B5804BEECF60D3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763207662, "uuid": "a30dd0a0-6aef-482e-9b99-a5b0c0269ba3", "value": "1536:CaQwt7ZeeY1I4mq/MivqwTx5spRCv8uybVR:C/GeB1B/jxjspRHuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763207662, "uuid": "181e6353-c9a4-4e05-8683-9ea1135a26f7", "value": 54984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763207662, "uuid": "943394bf-d971-4abc-b35c-1c5b4f101e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763207662, "uuid": "82fb8d1d-ecb3-4ff7-9fc1-bd69124185cc", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601b37d6-c25f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763237533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763237533, "uuid": "f4d88d47-a97d-4ebb-9241-4c4f28aa02ec", "comment": "Malware payload (Mirai)", "value": "e5b1727e88fd7b1d3a31c0f7c9fc22ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763237533, "uuid": "68f6093b-9fa1-4668-b060-dab4dbe4dee7", "comment": "Malware payload (Mirai)", "value": "bb719d6a4197953f3bf91eff21abb3692df553e35cf0c78a87ca25834731b6dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763237533, "uuid": "95fffb2f-b622-4f66-bc79-a60747668ea9", "comment": "Malware payload (Mirai)", "value": "2743c4077feb7b21a2e1aa5d654d193bf50ff4da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763237533, "uuid": "ebf7c4e4-04c9-4435-82a9-4cde0d006ed5", "comment": "Malware payload (Mirai)", "value": "83535e91aeb4adcf843579b9d8d57616a1891ee0123c0eea4187a3a1a2e6ca4fe0c0ad94edd18196ca606287120d146a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763237533, "uuid": "fc529ee7-fda0-46af-862d-aba8ac1d79c3", "value": "T1B3C34CDAB801DE3DF90FD5B644670D0EB935A3A156831F26225BFD93AD331A4BC02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763237533, "uuid": "87f5f839-479c-4bba-944a-bc9aaaa4f02d", "value": "3072:Kt3/OvE28W6X1MFFgGXpb3ZNaNwTNDHyM:yOvE28W6mF5bpNdNDHyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763237533, "uuid": "f835ee19-ed6b-465a-931e-1e1565f53fd4", "value": 118732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763237533, "uuid": "fe29103f-c607-43ca-b629-8db8715552ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763237533, "uuid": "1b89750d-8aec-40fc-a133-74e94e9a37b0", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9092f798-c216-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763206261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206261, "uuid": "11b03eef-5d8a-4e4c-95ef-85389da7e5a8", "comment": "Malware payload (SalatStealer)", "value": "2a887d6c79c66d88a5364c42be5337ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206261, "uuid": "2a6d3d25-041b-4046-8791-441bf0dfaa82", "comment": "Malware payload (SalatStealer)", "value": "bc584641fa7be701f0ba164e43dc4a0ea24944b1f40fce23d8b7143eb36ee64b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206261, "uuid": "f1e60230-d2c6-4276-9793-56bce52bf740", "comment": "Malware payload (SalatStealer)", "value": "be320a1d2a7da34d80ead49a56dd7d3fcad2c959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206261, "uuid": "5cce5e07-65b9-4102-9963-3eba2de24b5a", "comment": "Malware payload (SalatStealer)", "value": "d66ed364acbcde81791bd17b85fc2794323c70e5ce03158f9b500426e8c85ce83d893afc2ac087d672b450dfa7c83365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206261, "uuid": "99541dd8-4fcc-4e1b-b523-8c894398db1c", "value": "T1E016021BFD478960D1041B3EC4B704458369D78237A7D74F3E8B23552A633AAE94EACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206261, "uuid": "e11cb751-a764-4462-adbd-4e76f0d3a0f3", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206261, "uuid": "2facdf2b-90bb-41df-a738-d24a277e5dc2", "value": "98304:iqmxXZxh7+6AuLlXcIpp3W++QeNppusUvPz9cvFYW:iqmx1+6A8dbLetsavFYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763206261, "uuid": "55023222-8341-4f09-8536-c27f49dbf516", "value": 4375552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763206261, "uuid": "505f5c9d-6e90-4360-aec3-764a8d2e51c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206261, "uuid": "7e56c444-fede-4584-9433-b381086b6f2b", "value": "Neverlose.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81af74a-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200717, "uuid": "fc2e7926-c8f9-4db4-a542-d320a7b0010d", "comment": "Malware payload (Mirai)", "value": "7b93203c62ab8ed7e3edaee86f453f9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200717, "uuid": "d1a33f55-a806-450e-a088-72d1aa51f06b", "comment": "Malware payload (Mirai)", "value": "bcd4e1f9b637abda55aa9838c121c59716ef76c1d3e0d91b623930b4add06422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200717, "uuid": "0bb0236d-76c4-4ca5-972e-7e1b506f334d", "comment": "Malware payload (Mirai)", "value": "e076743b212ccddff327478728c4f6dfc0ac8aad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200717, "uuid": "059b28e6-9508-4e02-b49e-2af927329960", "comment": "Malware payload (Mirai)", "value": "8cca6dc00b1ebf25b9142cb32b18667fb0a3094b2544a28b8eced71e1710e995d8ab12f1240ebe5159b250da20ccfdbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200717, "uuid": "b080af0f-3a78-40e7-9018-c3705dbcebf1", "value": "T1617349C9F401DEAEF84FDABE4C524F486072B3B50A430F365B93FDA7AD21158295AD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200717, "uuid": "1701ab74-d566-45d8-b347-368009484260", "value": "1536:pNCbQ6/Brz7la//A1aPG+vVEYnIk8tby2QeuacWjcW0JcWcBQsUgCxoPPDqGkzg:pNC3BBarvV9x2QeuacWjcW0JcWcBVxCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200717, "uuid": "3abd3317-6e3d-4bc2-bb4d-8815eb0866d2", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200717, "uuid": "ba89564f-0440-4b5d-ba08-6873f9757a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200717, "uuid": "cd861606-90e1-4da8-a0b7-eb828f006059", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4185d15-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240761, "uuid": "675fc7b7-16ec-4f89-9c78-75dd88d3713a", "comment": "Malware payload (Mirai)", "value": "50074c58c2f98012843a63f17f1746d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240761, "uuid": "b58b9ae4-7e37-4ba0-9d5c-4e894b8d2503", "comment": "Malware payload (Mirai)", "value": "bd78c7116831953c7c8a3db5061f5893c023788677eb5580612efc7331f9a112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240761, "uuid": "78087d7e-b6c1-49b6-88ba-7af0900da8d4", "comment": "Malware payload (Mirai)", "value": "605dec818ef4287db83e8bb03e1e34da39179e3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240761, "uuid": "aa41b07d-79a7-4fea-8554-04eb88db9d5d", "comment": "Malware payload (Mirai)", "value": "f6c5a405e2d48dd0446acbdac02b63b1a7b9068aeb860f5840d8a7cbf716c49c608ac5cad438a92cba486346e3d01adf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240761, "uuid": "5e438b68-fdd8-4766-b8c0-a8ccf563bcfb", "value": "T1ED63821E7E319FBCFAAA863447B78E12564833DA3BD1C585D1ACD6012D6064E341FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240761, "uuid": "ac938480-da36-4b4d-8557-33e524cb8088", "value": "768:K5n8MDa5uH15uHpiBhMecmggBhMMWyEqBhMRj+gWF5XgSI8MDZEe5sWv5jLmtMgR:89kgxmSSZey4iALMJGgSn3ueGoLNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240761, "uuid": "fc17e88b-c5b8-4427-ac35-cbc6f145593b", "value": 72188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240761, "uuid": "edc316d7-bf85-4725-af79-164f93fe5548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240761, "uuid": "0c09fbdc-22d8-4c29-be92-88e365a6959e", "value": "brichs.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516537c9-c1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763192412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192412, "uuid": "6da37b11-e579-4bad-bb77-ee9687b30c69", "comment": "Malware payload (Mirai)", "value": "f1aec3ae42527e2950a03abcffd33c4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192412, "uuid": "ccd7ea64-576e-4593-90e4-fe7722a8eabf", "comment": "Malware payload (Mirai)", "value": "bdd4a4733bf89f0ac23e72381347b1fe646419f17653b5a5e0cf9ce899c5a08d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192412, "uuid": "0561611d-b8f2-400e-907d-a76d104a95c2", "comment": "Malware payload (Mirai)", "value": "b708b6e918f18ddce9e92eb1bcb05c82d2750cd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192412, "uuid": "44fe022e-60a9-4a79-b360-46e45da1a716", "comment": "Malware payload (Mirai)", "value": "e15ccfca02f5ac97e6728ccf24db21ab506691082d294afa5845d613f1d430791004592da7979d8db3d42bbe7f2507d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192412, "uuid": "f9bf52ba-19ce-4539-adbf-e712e2541255", "value": "T144B36C21B4381E27C4E1A57A12F74762F5F257CD15A88A1F7D720E8FEF226502A03EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192412, "uuid": "0b01289a-a0e4-495e-bfe2-9dbb0131da66", "value": "1536:43uBr0iLAddmKMeRe9T5p9/jZHCZWtB5wWjJMjmtnx4Ym5DmUM+J3tUmQ:sxW/xztMKV2YOCG+mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763192412, "uuid": "d52a195e-0d54-48f1-9f04-66efb5321317", "value": 109712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763192412, "uuid": "930acf3e-96e9-4053-aab7-eec324ec5593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192412, "uuid": "506ff884-27da-4952-bcbf-7b859fca07a8", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f622815-c1ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763188945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763188945, "uuid": "1328de7d-be77-4140-9100-9633a9c771e8", "comment": "Malware payload (Mirai)", "value": "a9c356c5ed286fc4ff37233636f9638b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763188945, "uuid": "c2172abc-2fb0-41ca-9520-83edc8e81fe5", "comment": "Malware payload (Mirai)", "value": "be4c1d0c512f6e088263623c04272c7b091f6dfe1762947c20e743b020248a01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763188945, "uuid": "d882ea04-f512-4546-ad6f-3238852a010e", "comment": "Malware payload (Mirai)", "value": "bec6e8410b6bf57710c1bb58e5698c827e96fa27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763188945, "uuid": "b541bba2-4a33-4a00-b1bf-a40c303f832d", "comment": "Malware payload (Mirai)", "value": "1d65ce8c2decfd8a08778f7e3e146bf23f86c24e98db6319803791f50074fcb297f2c4cae0c75bafecb7a57aacc13b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763188945, "uuid": "a138bbed-3a48-4db7-bdb0-765e2c6a283e", "value": "T103939D27D82A6DA8C1650175B4E9CF351B23E4C052532EF709E6C6BBA057DE8F806BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763188945, "uuid": "ac8eb457-4615-4b43-98d3-a7673b9d617d", "value": "1536:/I/HxYz2Lg4u/ksaBAv5MIduKUEeo7KrMsMCDVq9Q1gC4I:QPxYiBi9EYMIdBUwAMsM0sMgC4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763188945, "uuid": "79d303dc-8629-4258-b4ec-894f6fc33e4d", "value": 96560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763188945, "uuid": "1d3af1f8-20c1-476d-8ec5-680316e053d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763188945, "uuid": "a34b3e3d-d5c3-4163-8362-cae602b39b88", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a408b711-c249-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763228198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228198, "uuid": "a13ff124-801a-44d2-8a6c-c4a8657d2541", "comment": "Malware payload (Mirai)", "value": "2b96212f2ad99ff0d1b3dc441f3ed534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228198, "uuid": "e7b586fb-4125-4bcf-bd1a-2f05902efe5d", "comment": "Malware payload (Mirai)", "value": "c0e9a142c33347f399bfdf1069309e9a8eed39e79ee22e494ffd58af2631abc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228198, "uuid": "9b203947-5289-4f7f-9197-809d6d9303fb", "comment": "Malware payload (Mirai)", "value": "82a3445455403fd7f5e21a765cc632aa63a17f6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228198, "uuid": "9f2e6148-b36f-4e63-bf12-a5252b716b5a", "comment": "Malware payload (Mirai)", "value": "a8fea02b28c3111b72b65e829042c9e7817115ffe38179681c36838acc6d4fcb15d477548a92415efc9018d398f61aba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228198, "uuid": "ad4dee36-3353-4c89-ae24-3c28d204a931", "value": "T15863027CE858180ECDAA5CB4E22D13131FE9A509ABAB81854635FCC4F577B0AF50D4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228198, "uuid": "85b95ea4-c95f-4217-baaa-251ea636416e", "value": "1536:JAIf90NwPmRL5xlbphrBn3geDXWp6p0osg/A:JF9mtvlbphrBXDm+tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763228198, "uuid": "85231f67-9874-465b-a749-e906d95f9bb1", "value": 71268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763228198, "uuid": "48934d91-6431-4028-8595-d1193ee64e7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228198, "uuid": "a1e92157-2154-45b4-9518-b70702ac01a5", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e3da95-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239899, "uuid": "e4a2b1fa-1060-433b-bd2a-04245400130d", "comment": "Malware payload (Mirai)", "value": "4b4f09eddba6d8f4bf63a7c79ac85281", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239899, "uuid": "618c3fe8-80de-47c1-b87e-b53dc63de74d", "comment": "Malware payload (Mirai)", "value": "c3a2fc483c0968ea4bdd1cbb75096e71c1fdc7fa76573c41d07171f3d5009aba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239899, "uuid": "a44649a8-1bee-4508-b53d-cdd91a7686a2", "comment": "Malware payload (Mirai)", "value": "294f7ad3c6e744453e579374649be7570c118f67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239899, "uuid": "71e57a4e-5f9c-46b0-8f16-7d2c4b59fc13", "comment": "Malware payload (Mirai)", "value": "d4dafa593dfcb47009310a1b55db75bc14908a08a58bb8fe699cffd51dea72510d78131e6ed80aa0c325d16463765b98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239899, "uuid": "2057839e-a085-479c-a71c-55278d167bd6", "value": "T1DEC32902F98184FCC0CAC1341B6FA63AA976F1DD1238B2EB7BD4AF122D4EE615D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239899, "uuid": "af2b9b93-31fc-4743-b2d9-5c77ecb28aa9", "value": "3072:NY835gAcEQwtZ7cHIzO8SoMFmIRHp9hAtD7bhto1FSazQBZRIattnb:Nn35gAcEQwtZ7cHIzrSoMFmIRHp9hAdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239899, "uuid": "4d669354-df37-4e81-b735-f51b1877ba54", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239899, "uuid": "2fabbe3b-16ea-4110-8905-eae9c1085e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239899, "uuid": "d8ec7b58-51b2-42a2-828d-d2941c4d70ed", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb2c8bf-c252-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763231835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231835, "uuid": "4c6ed6a7-14e2-46dc-b950-f9693ab6eeb5", "comment": "Malware payload (Mirai)", "value": "404013180aa2b54c6205b361d9c37109", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231835, "uuid": "cd2edb96-c273-4039-b2fa-15a11622b739", "comment": "Malware payload (Mirai)", "value": "c614e545e0760fa9404f59236693577253bf4cf7e6f888568d46ff956a553be4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231835, "uuid": "85adc8df-dfd7-4253-b1c3-5dd8dcd829ec", "comment": "Malware payload (Mirai)", "value": "1e12e5162f1a3940314c9d805bdceaa149236842", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231835, "uuid": "9db03c0b-9634-43be-9af0-4397617ce1c2", "comment": "Malware payload (Mirai)", "value": "0d460f1d014b89144f4a8f686f83d22b2552bd534b782d5a0c44648e4a8096474fd99b200d21cbd63d26a38d8661f229", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231835, "uuid": "b41d75ab-18a7-431f-8562-7dab7927897f", "value": "T13383F74AFC819B15D5D922BAFE1E128D331317A8E3EF7203DD115B24778A92B0E7B911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231835, "uuid": "b74187c2-48b9-4195-8c48-35bacfcf70da", "value": "1536:BtnLmdkD+Q0yyGCTFq2Q5OAKOhMXK9c5RorVdncUWqklltc4i4XQm+gzuybVRy:GdS+3GCTU/EOWXgARorVdncUoc6XX/z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231835, "uuid": "a651d017-3512-4f5c-9f59-051199d50e2d", "value": 85852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231835, "uuid": "12d75043-8f9d-4bd7-bfe3-58bb1f63ef26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231835, "uuid": "d2719909-f7a2-4567-a301-410b3b7a0479", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada7993b-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241529, "uuid": "7cf08e7b-2b95-4008-ba1c-e9e643d17fad", "comment": "Malware payload (Mirai)", "value": "8defe43e698345fb64adca5b676c9aa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241529, "uuid": "9475eacf-db6e-4d84-b2de-b84974558eea", "comment": "Malware payload (Mirai)", "value": "c62b9aa9ae196e2bde6dd30bcd5e338e78f25a4ecaa313d1b7c318974716bfae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241529, "uuid": "2b99acb6-bfc9-45ca-b44d-35274411aeac", "comment": "Malware payload (Mirai)", "value": "50ec5d32880fbb674c5fc97aeaa72f43002ba694", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241529, "uuid": "76cd7037-18a4-49bd-b3a1-3d4f4edcf938", "comment": "Malware payload (Mirai)", "value": "73db8632895bad82486a486f371b254198fae0fc4cf470a1a543d12ed5b29220c0413a8304854458d1b02e651f169cc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241529, "uuid": "ce5fe7cd-a201-49ca-a437-70e147c7f33f", "value": "T184834B717B360E17C0E4A57A61EB4B26B2F547C911A8C60B3EB10D9DBF656603603EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241529, "uuid": "3931c320-c72a-4d5a-89ac-627ec4d8692e", "value": "1536:aLhgvWQs3i1VZHWy6XMqvmp0EQAIWoQrwNbsR7OtpQtSDVtCyc:aLL/XMqOpIWVrf7OhDVEyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241529, "uuid": "968337c7-9ce2-46c5-b091-2a2dd00519da", "value": 83428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241529, "uuid": "ab4befdd-33b2-43cd-a205-29298603d229", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241529, "uuid": "2455e22e-0300-479e-b51a-2d35c8fdf78c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371aaebf-c237-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763220285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220285, "uuid": "841c2ae0-5f3d-4fb1-afca-2a3017517a45", "comment": "Malware payload (ACRStealer)", "value": "ee08ffe1e7266e6198adbf3039e87e31", "object_relation": "md5", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220285, "uuid": "2a17f5a9-f044-490e-91b3-f2f05ed9bcd8", "comment": "Malware payload (ACRStealer)", "value": "c6ce91efa1b338d4570e481a25aa6097ebbdb4c0788d4c693a9b8864965cedf0", "object_relation": "sha256", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220285, "uuid": "ebfd927d-e3f5-4ba4-8dde-b2c046c51f1c", "comment": "Malware payload (ACRStealer)", "value": "43336e31345e1cc008e535707143bcc245e8a3e8", "object_relation": "sha1", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220285, "uuid": "bdd57cb1-af70-46b0-b9f1-af60634b3c39", "comment": "Malware payload (ACRStealer)", "value": "bb81cd90d8cdea937f58ffdabf5ba02aa87fb6f59b0cdbf2247049938d67272638ebac9c5def8486b906484f7699f33d", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220285, "uuid": "36bcf5d2-0f1f-4c70-b3d8-9da337e0a567", "value": "T1FC27336A6B73CB9ACC7AC4379E60C914A1E188F22AC5755359B039B32F9FFEE3151500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220285, "uuid": "0f529a97-d087-4edc-932e-05405a69e9fc", "value": "393216:U0ur4xToBiuSBEAVJ7yTVN+Pw+zaJrgdNFDIfmaVt4LepeSencg8K:U0urSToBvS7lyTqwyNpAB7Gep4n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220285, "uuid": "43527114-25d3-4ec5-b179-e92c89877891", "value": 22013232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220285, "uuid": "10a18a78-fed5-43a4-b878-8ac3c7caa3a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220285, "uuid": "062f9029-7cc5-4e8f-8409-d1505b05c519", "value": "SET-UP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832f9e34-c1ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763189059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189059, "uuid": "0c1d6208-9d88-47a5-97d4-b27743dcbd25", "comment": "Malware payload (Mirai)", "value": "519ea778a471d5dda9f9292c84eb72bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189059, "uuid": "21450ba7-df69-4760-954b-ee967f88c6d0", "comment": "Malware payload (Mirai)", "value": "c748ea589b8a2d81dc0a9eb9ef348201052069434b86395e6b89380f1a254661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189059, "uuid": "e8cdf89e-0b9a-4e2a-a80f-f17fe61fc19c", "comment": "Malware payload (Mirai)", "value": "45977a3eddbe269775de6148478993ca6af45d3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189059, "uuid": "3db92ced-d6f1-4e6e-8a4a-058f30893f77", "comment": "Malware payload (Mirai)", "value": "b5d5d8631f9cadc34aacd28dc20b95db036fd29936f860ffc3efb54d0eb36fd66e197d868016293b897ed58a2e8ff79a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189059, "uuid": "9200a3ad-b0fd-4490-88f3-aed734ff3a2b", "value": "T1DEB32996FC815B22E5D712BEFA2D118E33131BA8E3DE32229E145F2533C652B0D7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189059, "uuid": "13cc2bcf-c86e-45e3-950d-4925868555f2", "value": "1536:3bny3KiQ1Bk5+kN6bvxhma9/u4a+WndeDSp7ED+7Qao7bV+XQDVRibPU3LyB7QvE:+lcvFhWdOStm+7QaocPU3LyBMvZ9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763189059, "uuid": "01dca91b-4a2b-4042-9ab6-90f1df15313c", "value": 116668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763189059, "uuid": "1176c5fe-c53a-4e9e-afe6-b017023e16cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189059, "uuid": "0be04815-9b55-41f4-844d-45f5a468db97", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dbf306-c266-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763240794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240794, "uuid": "0c224d03-0254-4964-a71e-8c9d9391049d", "comment": "Malware payload", "value": "2bc373a72a25f0cfe1cf112df142365a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240794, "uuid": "72f89533-9da9-482b-81ce-6e9f6b585495", "comment": "Malware payload", "value": "c915964fdf48a6fc1f6d2f2834f9efbcda1ec1cfea87f8d8d59d3e0de69f3bd1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240794, "uuid": "3fd4ab31-bae4-4db6-9862-30108756860e", "comment": "Malware payload", "value": "dc3730398c20bd484fcc8add2971be696de919b7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240794, "uuid": "6f1f7409-0120-4752-834e-552140acd5e3", "comment": "Malware payload", "value": "1c7dff0245c27769064ae5733c953e34626d65a9da69ad5677067ec5088cd730b5c13454a8b020b305222d8160ac17f8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240794, "uuid": "202bdd60-1231-49ab-9e96-65e8eee038fd", "value": "T143F4E88325EB0CA9DDD32BBC21DB6339A735FE308B7A4B678244C13568131D56D6EB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240794, "uuid": "46ce4ec9-dcfd-4ca5-a851-238498bd9995", "value": "9e98882cf9f3adc01423b7cf0d60f531", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240794, "uuid": "7b5614a5-d65e-492b-abed-35742134b23b", "value": "12288:b/vL9CS5HPpWykHEiCJDnq1mP6fTQF5SH8E9QxW8jLi:jvL9CavYyqCJDq1YE9QxW8jLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240794, "uuid": "f32f3d84-6ae9-43b0-86b0-0d3789417a9a", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240794, "uuid": "154f1d66-8b4c-4b17-9938-b10a73935b01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240794, "uuid": "29d7d46a-d38c-443d-878f-174f3655a7ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8172470-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240768, "uuid": "cb4720ec-1d3d-4ef3-a584-205623da1ea4", "comment": "Malware payload (Mirai)", "value": "b22332d0d6ff1b83d17b56febb9acb65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240768, "uuid": "93c9e99f-454f-4b6d-9039-ed603bd17dbb", "comment": "Malware payload (Mirai)", "value": "cc7a472d0b918025b173e5e852718dfac294d42ff6ea3bbdb3bc67ddad9f97ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240768, "uuid": "b5938c23-96fd-4e66-bc61-1e1ce4b0d3c2", "comment": "Malware payload (Mirai)", "value": "ecbd7ebef8742d0ca50b4e4a5edcbe813da2ce2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240768, "uuid": "a490444c-9c17-43d0-ac8c-78fc38f1fccf", "comment": "Malware payload (Mirai)", "value": "f772a20ce81d059afef25e73af7765307100d4c05c605a425637ff4422340133eec84d9ded5b76a3feab392e7bc147c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240768, "uuid": "b6095159-a321-4ede-b471-9b6b35fafab5", "value": "T13C231AC8F443D9F8ED4A06742472FB3A9BB2F5BB2328DE43D7A495236C51742A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240768, "uuid": "081fe54a-2ee7-4cd2-b95f-65e77ca99dd2", "value": "1536:XZ4C3s5wbIx4p9CKY1KmPUCwLEIwq5ugce:XZls5wbIx4p9CKYcmPXwIIwcuZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240768, "uuid": "238b11fc-1671-4af0-af80-ea4e007e2003", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240768, "uuid": "08a42622-f97f-4b41-8bc4-64c2f77a24ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240768, "uuid": "392173b2-2946-4e7d-9e74-9b52ec0e1ffd", "value": "brichs.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fa6a25-c217-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763206505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206505, "uuid": "5246f37f-cd92-4450-be1a-e120b52542c0", "comment": "Malware payload (Stealc)", "value": "45dfb6c7a2022889eb7aa5d0fb464965", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206505, "uuid": "e1f056c8-c124-40e7-8b83-277633cdab17", "comment": "Malware payload (Stealc)", "value": "cd36914f7b53d588ef21c1e919a53398753e0df4f207b478654b32716f5c8f55", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206505, "uuid": "6e8d3ef7-9506-4b5d-9d04-c58c8bc25134", "comment": "Malware payload (Stealc)", "value": "29f3117edb374d53816324e0c25b21464b640532", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206505, "uuid": "d9990379-d2e7-4a98-89a1-4ef34d90ec44", "comment": "Malware payload (Stealc)", "value": "f892a723c42bab318c5908dc5c420746feae8544d0ccc20dddad548ca228ea68ba3da9dde55901a1e7030125ba0f52e1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206505, "uuid": "148d91bd-d6b8-42a7-b685-04f97a3f46f0", "value": "T1E434239E1BDCC24DDC2CAB7E2314719DF7D769A92BB13B491AF1B092D2CCB326205524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206505, "uuid": "7985b9d4-fd94-4a87-a858-944af58d86a4", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206505, "uuid": "59342038-95ac-4d19-ac86-cc28c3804204", "value": "6144:2WPOsiFHMMl38ID9VuCGVIePiBxKtxMMrk:2WPriFHMMt8A9YM8MM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763206505, "uuid": "37448bc3-eb0e-4e41-b911-0df9b0041c65", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763206505, "uuid": "eab06571-7317-48d0-9457-b47b307aec63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206505, "uuid": "2b4dcd0f-705c-4447-a05f-37b1ab70275f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0d2442-c1f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763193983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193983, "uuid": "ef75fa7b-ced6-4530-a6d7-f3b7146db1c4", "comment": "Malware payload (Mirai)", "value": "65c61941a9572dfcaa077395e8033563", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193983, "uuid": "ab2ee8da-f754-4825-b389-9b3d6ead684f", "comment": "Malware payload (Mirai)", "value": "cdc6965c02c8b703a333573c757b5214e0f47830fab2601a3db10e8045b9a013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193983, "uuid": "aafbac1b-f209-407c-9264-b5a83ee4176d", "comment": "Malware payload (Mirai)", "value": "8e0688af92b3a0b2f8612712190df1d254fed6c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193983, "uuid": "29127308-fad6-4b96-a019-aceca3bf9348", "comment": "Malware payload (Mirai)", "value": "58ca810934fb32cebb9b8017ba7955672e2335d2302014cb8e4b663e7612b3ff7d5dafa70bb1e5c134163afe6f5226d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193983, "uuid": "05324e6d-36e3-4269-98ae-d41ee05e786d", "value": "T19783C6097F614EF7D8AFCC3749B95B05248C550B21A87B75B970E818F25F24F1AE38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193983, "uuid": "2d3e2f9a-e83d-47de-a5c2-039d1a97180a", "value": "1536:dC1RZpLqEIuVkN9Q35qTEC59Vp+Il9YNDpMaRBuybVRS:gzZZqEIuVk0pFlBuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763193983, "uuid": "e53d67c2-8865-4643-a989-0028997b9b15", "value": 81696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763193983, "uuid": "ed0f3e9b-56a3-4a30-85db-9e4878294cf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193983, "uuid": "c4e17462-7d0a-4ec4-902e-b728b1e7f530", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b006bb7d-c24e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763230366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230366, "uuid": "c98a7301-647a-4716-b116-a77a17846df5", "comment": "Malware payload (Mirai)", "value": "a61b0163aa4d3865e0c0b236fe00df9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230366, "uuid": "9ddbb126-c5d6-4543-a05c-04cc24d9cd30", "comment": "Malware payload (Mirai)", "value": "ce7ea8c1648fcb4720e47f3d08356f74b58dcf4f4d5030f970ffb5a8d5f23385", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230366, "uuid": "aead955a-65c8-4d24-9dda-ac81fac27dfd", "comment": "Malware payload (Mirai)", "value": "6597358a542377c0b21100c83d7a90c5b296aaef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230366, "uuid": "6b57efc5-8ba7-490a-aa5a-5326bd2e1106", "comment": "Malware payload (Mirai)", "value": "470c92cb2ddeaa51c609cdd4c30b2e8346d43a7f8b55592252f61114f6d618ce0bde498faafe01e4d7cfbf7737d467a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230366, "uuid": "e4833226-fc91-452a-84e2-dbca466e690a", "value": "T139830210D2E37435E8785FFAB5BD5052D2942CA1D02EF8367CC96E2C9EA5118C9FB0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230366, "uuid": "0e58bd92-b72a-4326-a325-c5e7d5b2abd1", "value": "1536:qsAC/9vNeRtwxFL0QakL87S2Nm4QpVya/fr2Ls3GahN/BXvMpCMp:H//9qtM4rkL87sMa3iLs39hN/NvMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230366, "uuid": "abc383fc-2518-4af8-87c0-fc1da74a30b2", "value": 83548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230366, "uuid": "da15657a-d740-4733-a880-195e428eaae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230366, "uuid": "6f80b180-d60f-4e03-aec3-91a96a2ff605", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec0c9fa-c217-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763206768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206768, "uuid": "1d4f4711-0df4-4ed6-a905-8e71e022c2eb", "comment": "Malware payload (SalatStealer)", "value": "df69d4aa1eb4c3788a847db831cec2c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206768, "uuid": "78216860-ebc2-4ef5-bbec-baf936780f01", "comment": "Malware payload (SalatStealer)", "value": "d0548666ce36e2c0a35ad6f3e8ebd78d6494e30becb1e1e12b5886a9b967784f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206768, "uuid": "e5c47e4d-ea25-46c8-a393-06a7df87bd55", "comment": "Malware payload (SalatStealer)", "value": "d1a432fce5663b4fb6a71aa916bf10027f2f41a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206768, "uuid": "73de26b5-d240-48d2-aaf4-98c0ad96c5bf", "comment": "Malware payload (SalatStealer)", "value": "15006c489e72a33f5031a619aac8ee59a0951ef18f6b2c85cd9e9acd3c88fd97603e38b6f779c4fe75b7016a8bc30a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206768, "uuid": "b2688831-cf5c-4c8e-8456-0792272f6db6", "value": "T1F1C65A01FA8B64F1E9075831416BB23F23305C048B28DBE7EB587E6AFC776A11976749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206768, "uuid": "152bee3a-4c98-4773-bdf1-e203059a4757", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206768, "uuid": "9a99402e-ace6-4466-9c77-8d8052b9d7c5", "value": "98304:zuMpNFmvg0va8y2Q7iiYP39CrBy8EUQbzI:xFEyIf9CrI1UQbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763206768, "uuid": "8e7852d4-4045-44a9-999f-0b3c31112816", "value": 12472320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763206768, "uuid": "d2fcebaf-5d91-41c9-8f58-0b8583b8dee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206768, "uuid": "32ffb5f3-4c4a-41b2-803f-76c7b7688740", "value": "RUSTcheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c42b54-c1ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763189243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189243, "uuid": "e0d81231-556e-4bfc-85cc-074dc1a41b7e", "comment": "Malware payload (Mirai)", "value": "72034cb2a1088f1e338f41088cfe25da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189243, "uuid": "b817cc90-27b3-4556-8947-04e8b5dab72a", "comment": "Malware payload (Mirai)", "value": "d1e59d8872f379cf537b3c84edb00d5f3bd72ac4d0d60c3af32dac9cd2eb6beb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189243, "uuid": "41d111c4-28d8-4cb0-ab6a-c74dde3c290a", "comment": "Malware payload (Mirai)", "value": "13b03fac1a73e85b639106296978f2837dc04e2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763189243, "uuid": "60116f24-6793-481c-997f-007f16808761", "comment": "Malware payload (Mirai)", "value": "5021bb3e828b3f2cbe1ddba9208bbf2b7fe48f5db3824fb33f8b6ad51a84e2fdd815352ad1ca418d6619870194d35b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189243, "uuid": "14ae3cca-8196-41d9-943f-6c1f866f5068", "value": "T1CED3D609BB610EBBE8AFCC370AE9170118CC695722B93F76B534D518F64B24B15E3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189243, "uuid": "a941bdf7-10b1-42eb-8414-952c6fef2c22", "value": "3072:aML4Q7d1eefpWQ/Puy/XUaSxkfbRt2QYt1rD1rW:aM77d1empWQ/PuaXUagkfbPYL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763189243, "uuid": "e2946a6f-8aa8-4764-97fe-2f29fdeb9311", "value": 140632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763189243, "uuid": "f69989cb-5f69-4997-a41e-491f640c57b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763189243, "uuid": "a3e8250f-085b-45a5-812a-73ea0d46c5c7", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f19084-c1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763185948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185948, "uuid": "5b5f02d6-aa96-4d2a-971c-f889e6a4cb0e", "comment": "Malware payload (Mirai)", "value": "663d69242d5aeafd96b0a75470601bc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185948, "uuid": "f8da6dd2-df4c-4b63-9c20-09e1f07380e2", "comment": "Malware payload (Mirai)", "value": "d37498c7db450f3201536869e7a89687f28c67bf15b8f488787d385459901a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185948, "uuid": "47891447-0564-41ab-9b12-6d04f926e7b0", "comment": "Malware payload (Mirai)", "value": "f27c3bcdc1cca1ddaa7eb8b3c0a49a4953f5be20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763185948, "uuid": "f6cf6bb6-7a17-40b3-b3e3-b41c216a1484", "comment": "Malware payload (Mirai)", "value": "1ad1a16bd9f6bd760f2be7e592b39ba903fac6ca3abd11a41028a641a50496903583b78207301d1847b5c8f423f0f20b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185948, "uuid": "4df74977-2d16-4f64-9374-c92941680a4b", "value": "T10BD3AE97F74724A1C86342F007CF5BDE6E9322829F5B99D76C6F693B18750DB0802B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185948, "uuid": "606ad00d-56b8-4755-b6cc-f6110dbfb100", "value": "1536:tTYxnwxKnkU66p8g0fbNQh9JaQeSOSQbIwIG60j1uRu1xZJPhgdS/LWA9:tsxwWR66p89Qh9JR9KI/GDMRuzhgdSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763185948, "uuid": "a7c41157-b6f3-42ab-a044-f5106dc0944d", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763185948, "uuid": "2e0f82f2-b565-470e-9098-ce6177959767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763185948, "uuid": "7d88282f-7dd4-45e7-8a15-cc0b0759a8d1", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5f4579-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230521, "uuid": "ee923ca2-901f-4c02-995d-ca4bb89a114f", "comment": "Malware payload", "value": "879f251df0874157935f479fc461fc4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230521, "uuid": "36347b32-69f5-4e21-a50b-5533b2c529d8", "comment": "Malware payload", "value": "d50d571877adadf7c0b550b2e30b180821d5851197a4c59f6ef49e2302260c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230521, "uuid": "fd7b88d6-925f-4337-ad28-f2f7ae3d9e54", "comment": "Malware payload", "value": "e8ae76cbc9768096134bf13be67a1a81d67d2c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230521, "uuid": "c16574a2-1947-41ca-9352-ca7023033a46", "comment": "Malware payload", "value": "ea2815827dbc71575985e5a67869eccdcd2f21d3372c883758451cacc721c04168ac430ebe2a5c0b699c561cc4e7bd92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230521, "uuid": "bb167878-69f2-4357-be8d-15a4f19db897", "value": "T10AB5AF65ABA420F8D56BC13CC9B35517EAF2F4551370A7CF07A0C6A52F237E09A3A391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230521, "uuid": "e28a0bb7-01b5-45ca-b582-33e325007478", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230521, "uuid": "376afb43-0741-43fb-af93-7c84558cd176", "value": "49152:F3f13mS5Az6MuwHCjiDP4qI9XWKvDVVH20vDNn:FvMlz6MuwHCjiDnwVH20vDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230521, "uuid": "1d508960-3c6a-4954-9af6-485072a3d31a", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230521, "uuid": "183033cb-3ebb-4d4f-b049-08e5ab7f9f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230521, "uuid": "59c71b63-fd4b-4d8a-bb9e-d0562abc19a7", "value": "idhy8zzf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234cddba-c252-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763231848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231848, "uuid": "67208c7e-79d2-4fdb-9686-8aaef22e9602", "comment": "Malware payload (Mirai)", "value": "3cd941849cd63d3ee0c0e472365ddeb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231848, "uuid": "0c17708f-e55e-4f96-8801-801d94843b63", "comment": "Malware payload (Mirai)", "value": "d565336a647d10ba4d5f482052e301e55006ebd4ccb4716b3e87d0f7f522ddc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231848, "uuid": "abec2d17-f362-448b-9a11-255dfbd3bba1", "comment": "Malware payload (Mirai)", "value": "884036edb37d0900c5d257fbc29f455fde74437d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763231848, "uuid": "668edbb7-b24a-432c-a28e-fc3146cc61d3", "comment": "Malware payload (Mirai)", "value": "5e683177afb79d78376aa517e02aec78fd522e1a2d5bc4b96ace8ed68a198b2206bded6ed89a927fd38bb02c3497c3f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231848, "uuid": "b4a9dcfd-f7f8-418e-9cf8-c5c874020920", "value": "T178B34A4273180F57C1970AB02E3F17F687BFE5E021E4BA89250E9B5A8275E37144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231848, "uuid": "afd7fdd2-8a9b-4b94-a02a-55b5cb2b3893", "value": "1536:SXXfJWeuWomtxzUZN/fyWpA+8pqnKlIpYwl5KD19j+JuM1+463tQcU:SXXfJ1uGHwzpbvn5y92ukZcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763231848, "uuid": "db79afff-a8d0-4e37-89cb-3d69cb6e778c", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763231848, "uuid": "e0006188-5327-43a1-b333-19322c40bb89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763231848, "uuid": "608ecffa-9cb5-473e-a9d0-89501b881ffb", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e49b8e2-c1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763195869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763195869, "uuid": "18d5ddcf-51f2-46d3-8c04-1e5a9e2c9a62", "comment": "Malware payload (SalatStealer)", "value": "c6520ac2b03853666e3da11b86e6ae84", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763195869, "uuid": "a3dea45e-f2e5-432d-8d8d-a12891ce8212", "comment": "Malware payload (SalatStealer)", "value": "d5d4ad22502a7479bbd80571671dcebcce09ae47ce6688e32328e6c5b5758004", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763195869, "uuid": "5ae0336e-0566-4a1f-9372-63cffa343c98", "comment": "Malware payload (SalatStealer)", "value": "59ee6b7bd30f60355c34291141eabd619b523922", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763195869, "uuid": "c2de9ed2-a085-4878-b1ef-a68a237bb599", "comment": "Malware payload (SalatStealer)", "value": "c5f69830424ea591c5c0e3fd751fc6fc27aad94db546759d05e838f5c275afda1477ef1854aad4df29274d3c11820d9a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763195869, "uuid": "6e876d02-26de-4232-beec-039906269ba2", "value": "T155163384A6F5761ED11D313A0ED67EE57EFC38A8BA534DCD7B104A2CE0CAD18E61206D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763195869, "uuid": "31969951-240c-425d-afd3-defa33196d23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763195869, "uuid": "8df36c52-957f-4118-822c-b72ecbc923d5", "value": "98304:ZxS//3bkza4S/dCPr3YjBspxrU0sKCvO8/ya8d:LSHbkza4ZPT4BIJUbhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763195869, "uuid": "8721913a-4281-4857-8175-1807971c3289", "value": 4144128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763195869, "uuid": "2e1e9b81-cb88-40de-8dd0-2e3e9096e074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763195869, "uuid": "f6397e91-c783-423b-8fb7-6eb0478bde96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e3a333-c1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763186708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186708, "uuid": "4ba25a0f-3f0d-4edd-9816-96ed4e5d8151", "comment": "Malware payload (Mirai)", "value": "0b6cdade72b39a919de71f1629e3264f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186708, "uuid": "009b55e7-e947-4e2f-b9fa-b378e44ce0aa", "comment": "Malware payload (Mirai)", "value": "d679de5ce514c4b6923b0e61f1cefa9062adcc416aaff02887fd89a3fea1c7b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186708, "uuid": "03a080b0-a27a-4fdc-95d4-5e799db3a957", "comment": "Malware payload (Mirai)", "value": "33348fe1e4380ea68b441377389fbc8e4d041e87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186708, "uuid": "230034cb-ff30-4099-b3f1-5d614e1778b3", "comment": "Malware payload (Mirai)", "value": "559676a6d1469d2ad59245c79edd9c03f5a64ff19cbed4f92e1ad04dfd12d0d27f90509477c283ce5cd05b67bf3a40e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186708, "uuid": "1bf2160e-be25-4e38-b7ca-6747d66c6510", "value": "T13B631280663686B3D6135DBBFD2C449B7E5209F4F85D28BB372829582B80544CDE08DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186708, "uuid": "0b27dfe5-8034-40f6-bd21-629c165d3f2f", "value": "1536:qYN51VZX6ik9TT4gHiWn91S0R6FFHLCtNIe4fyqvyKM9io:qYtVl6lT4gHi0q0czHLCzIeUy5KMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763186708, "uuid": "f08c50c3-2cb7-4b6c-b7fa-9d87b3c72a06", "value": 71284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763186708, "uuid": "ba433b3e-7b58-415f-8dc5-2d1719e36f13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186708, "uuid": "6b857d67-589d-4015-9c8c-e702dd923702", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ac96bd-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240635, "uuid": "5292d609-1128-438a-95b2-24bc262d7c72", "comment": "Malware payload (Mirai)", "value": "458e48651894b3d64f2c0b7979b24f38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240635, "uuid": "61c729a1-420c-4814-b46b-25769dd5406c", "comment": "Malware payload (Mirai)", "value": "d6a771a59c6c498c09ee630ecd51c507b5bf0947eb822aaeaff64eeb87c07350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240635, "uuid": "ad8a1a57-bb56-4563-a9d1-0aaf38dc2302", "comment": "Malware payload (Mirai)", "value": "96e2bfc9402a8cc4c864ed2fae792e455017e6dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240635, "uuid": "c9a6e80c-71df-4dbc-ba6d-5a0841ee0ea4", "comment": "Malware payload (Mirai)", "value": "3821b4d35c92b97f203d37202472a42648cd1d92da936b559fd1dea12a2390fdcbff4e5bc0f951c7f01d7c39869eb170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240635, "uuid": "91631c12-ce27-46b3-afc7-23282ad5ce2a", "value": "T1F223F114B366A29BD506307BA275FC0604AB7ABCD2B35A1D319440F43C7299B52F97CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240635, "uuid": "4e72ab74-5216-4d07-a3d7-a9eb4beb8d5f", "value": "768:sdMby+mEJQuoNVhHL4HKTO5CKblWW/4q4h/BOIHW/hrdqSu9q3UELe7TXChARK9H:sdMbyUoPx4KTO5CKblWW8B/8rdqSTLeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240635, "uuid": "6995cbca-093f-4ade-9d60-126ce826c727", "value": 46676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240635, "uuid": "e6600fac-34f9-4ae4-971d-6775644e862b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240635, "uuid": "fde2f802-267b-4bb9-b0e0-d69186fb9340", "value": "brichs.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f55100-c26a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763242289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242289, "uuid": "c3026b2a-7fe4-46e3-9be2-1aca12d1013a", "comment": "Malware payload", "value": "c7c9642e23092b062465d09d81ede52f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242289, "uuid": "7307d112-2cc7-48c6-9ea7-52df4edc144e", "comment": "Malware payload", "value": "da4ef35175330e30c49a2d2bf5d53f039513f3f97d1218a1d61ef36e1feff0a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242289, "uuid": "a97dd7a2-369c-4657-a3bc-ccbbd8e1dbd2", "comment": "Malware payload", "value": "f8e13bf6f36edff30f8b60dc0752c04f1b84fef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763242289, "uuid": "7be90362-71d2-466b-8341-aeef5aa902ac", "comment": "Malware payload", "value": "4b47a584b04d2f88086bd49fb0ccb8cf9079d78df43395a133ddec5f660443f28b096db80696951e4c71f241117acb1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242289, "uuid": "8f3010af-197d-45eb-972c-9fef901e896a", "value": "T147F529176DA24AB6D06AE23488E281767770BC0D173167D32EA07E3B3E777C05976728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242289, "uuid": "c5e4da1b-a6c2-4690-8231-2304e9193bcf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242289, "uuid": "75d1f558-6e92-42cc-a4d1-b211ae321e1c", "value": "24576:XijQehxs0GHrFSptzhTGTz/Mf7nkjMM7970H1:XijNhxvptN4Y7a0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763242289, "uuid": "3b801c08-67e7-4d10-a96c-99cf3bda10d2", "value": 3573256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763242289, "uuid": "e4e7dd1e-c725-412e-9cdc-b253a426a24b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763242289, "uuid": "00a61dd5-3857-4fed-979a-93e4e2ee66e9", "value": "G\u0430Iaxis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df04cbde-c22a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763214983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763214983, "uuid": "b6aa8248-6e5f-4e81-8565-01de63f904b5", "comment": "Malware payload (Mirai)", "value": "0338561af0316a6dde65bb76b0f35402", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763214983, "uuid": "afc09ecc-c22d-4a5e-9e61-1631b1384cdd", "comment": "Malware payload (Mirai)", "value": "da8adcaf56946a834fb2eca25efe51dab83a897f25c0e66c2a60d8878477652c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763214983, "uuid": "cf727dfa-55d2-42c7-9b8f-149289f039ce", "comment": "Malware payload (Mirai)", "value": "3b16364fd2d43b629c306924e1e227c215994655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763214983, "uuid": "15d0c980-1854-47b0-8d94-029c409e5138", "comment": "Malware payload (Mirai)", "value": "d25c552ad5738566c34a8329f6eac2f246de6005116dd7b5ea335807384a27242c49d77a5223c59eef62ea4cfde6e0f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763214983, "uuid": "fbeda742-18cb-4ad5-b13e-ca78d503aab9", "value": "T1A0F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763214983, "uuid": "43f7daab-dc7c-476a-8b07-8ece4592625b", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHNfam:9FJMgWPZr8IaCWReS1WpPei7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763214983, "uuid": "50a33c55-664b-4d6c-adc0-261abba9a799", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763214983, "uuid": "9b06d5a3-c097-4add-bd10-838aea3ba172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763214983, "uuid": "79e724d5-0cc0-4d73-bdd2-c03ca4450c5f", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792f7717-c236-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1763219966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219966, "uuid": "ab2a753e-9135-4540-bd1f-b8a41b4df3a2", "comment": "Malware payload (Arechclient2)", "value": "d24fb3ab20c915c87e1a1bb407ae40bf", "object_relation": "md5", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219966, "uuid": "59faada6-e11a-41d6-a67a-ef966b61efda", "comment": "Malware payload (Arechclient2)", "value": "dad0fa10b1a6d9a987e9daeb74a457ab08d3a22dc4559682db7d0362115f3dc6", "object_relation": "sha256", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219966, "uuid": "27a24b63-c6da-492a-b224-5986513e66a1", "comment": "Malware payload (Arechclient2)", "value": "cd364041681760fb0af95fe6e8cbd3bbe8ccc4e0", "object_relation": "sha1", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763219966, "uuid": "4340eaf2-aaae-4022-ac40-61bceadaa79a", "comment": "Malware payload (Arechclient2)", "value": "4b45f66540fbaec2a5cceb64ee086181ff4c6a266f5fb7b38f9a976d47e02ecb54782a938505ff0666a000727f703616", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219966, "uuid": "bbd03164-1f92-4825-8a1b-f5b2f9241b79", "value": "T10221CB29C934F8D0436D72A089253D8B30A42E0BDBF9851DE21108EB6C59BE4EF2E19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219966, "uuid": "6c22dac7-10a6-4ba7-a50c-4f07d77679fa", "value": "24:qdq14K0xMuku7mM/MdRJQnvnlpbagkKl9PIWZsI5ZhgEY5kLnTY:qQ0xMYqmMdRJyvlRbjlxII/5ZhThnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763219966, "uuid": "25aa1600-d1b3-4192-a43c-e94d95725891", "value": 1157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763219966, "uuid": "0a6de6bb-0dc9-45a7-b797-d4e85cdb7724", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763219966, "uuid": "a7d56c8f-d5f1-410b-8ee8-cb9cab418972", "value": "Sf6fkVxNmm8v32mUd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6ba12a-c217-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763206632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206632, "uuid": "b1197375-eb0e-4f41-a927-e73db9c33366", "comment": "Malware payload (CoinMiner)", "value": "a6cf2bb96f20979d0d35965551b13fde", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206632, "uuid": "e5607182-d50a-41cd-80e1-ffd5e463e4d5", "comment": "Malware payload (CoinMiner)", "value": "dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206632, "uuid": "31b8e412-5243-4b16-9c2c-5005ebd9bbab", "comment": "Malware payload (CoinMiner)", "value": "e6b937abfac137698dc753005a8aa0a584620aa8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763206632, "uuid": "c28f69a8-b1ff-4915-a7d8-c978e5ba7940", "comment": "Malware payload (CoinMiner)", "value": "77aee5772c1169c3c32abaf67c7af2f7b1b6c3ff51862cfc807d46124b132ac22ee428b451a4815c8b16b965153549c2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206632, "uuid": "e5abbc96-2b86-4fd3-888d-e62baff3489f", "value": "T1E4753308476458F0F7A4E5888BCDACAE631AC95255F70F4ED4329CF35EC875336A2E68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206632, "uuid": "1259109e-4f0b-41c3-9d4d-4e6b643ad929", "value": "24576:hzfEtBkjj8t0D/p5fAZ6LNnw3sXQyXQ9enZM/CTC2c/w9pwTRfkxZwFfV3h:hzKB8j8y/fvNn005geS/AX99SVkbwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763206632, "uuid": "fb4a48f6-f369-44f0-968a-168241cb70c7", "value": 1560860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763206632, "uuid": "1569cf8c-961f-4795-999e-9998b78779ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763206632, "uuid": "410f45aa-5f07-4408-92ba-aa8903f21500", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac47ca5a-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241527, "uuid": "dc903401-940c-43b3-bd37-a3591da4e63f", "comment": "Malware payload (Mirai)", "value": "46b908dad0ab5bb2d7402aa03ed93746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241527, "uuid": "f23e5284-e2ed-48b8-8277-0b90f3213db7", "comment": "Malware payload (Mirai)", "value": "dc08f53196b64a4ad0e6bbd22652f96f39e332dc7cd49eab14515bf9eefb99ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241527, "uuid": "6051a55d-afe2-4938-a551-45cb860ceee3", "comment": "Malware payload (Mirai)", "value": "7b47d9a6bf94cd8bd99c0810faf454588dc896d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241527, "uuid": "1a071d21-fcc1-4e0d-b980-ab8efc600144", "comment": "Malware payload (Mirai)", "value": "648c2c60afa2b85c07b37d2ddd85121b714009c4079da972f113533070fd6c6e20420d376afb3019034ea76d677af780", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241527, "uuid": "ea067a9c-e3dc-499f-8021-36ed9c96cf7e", "value": "T101536BB6E4092FB4D0955D7075388E781B23E0C452532FB666AAC3B868C7E9DF500FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241527, "uuid": "735aefc6-361f-40ca-9b96-ee579f4e427e", "value": "768:TUdurywH43EpK6MbfUnWksfgD3uWUAdP6HRTtWCRP7TJ/IqwWeI:OGy23KZLys7WUAdP6HRJWCRvJMWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241527, "uuid": "f3228790-779f-4974-b333-1094e14803fd", "value": 66644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241527, "uuid": "b87f1d76-e666-4bde-9c0e-b5ded09d5dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241527, "uuid": "a2e5e96d-695d-4491-afff-a96f9624bd68", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e930d8-c24a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763228366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228366, "uuid": "ddbb5725-d722-46a2-81b9-01401f8490aa", "comment": "Malware payload (Mirai)", "value": "7efcd895eee38e4af1a56cb59a5e09df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228366, "uuid": "71e9e5db-4f1e-4a6d-8a21-140b9ee6b9da", "comment": "Malware payload (Mirai)", "value": "dc64c12b0ec473e915c9d177dd4731f88e8d3d50e6eb0c5dbd2f5d37c9a4da35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228366, "uuid": "a0e44daa-0cb6-4a83-9bb1-a7800e39e57d", "comment": "Malware payload (Mirai)", "value": "1491a46dfeec84f1907a3b450a133921d17bf31f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763228366, "uuid": "43463afa-fa78-4432-8b5e-e7a1638269ef", "comment": "Malware payload (Mirai)", "value": "ffbd06c3da3f1004f74879e7a7003cba49473121ea504fc010b4efc97c338d1c493dc3df8bfb0ba5461b6f5b813f409d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228366, "uuid": "34f5e74c-7ca3-4a03-9d99-5bd58cc141a7", "value": "T1AE6302B558000B9AF9AE84F6A7A203F1B93D08F3C441DC576706EAD6BE44FD6D4432E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228366, "uuid": "04a47e8b-08d0-46de-8608-28d7450dd51c", "value": "1536:644YCL8kQGQ9ble49SGFAyL9Coo3NQCbNjVJuaB:cYCL9AtTAii3aQVQaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763228366, "uuid": "3c1dd3ce-8a04-4388-b383-170b6729f3cc", "value": 69372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763228366, "uuid": "29eb80bb-8908-4a48-9ac8-474585461636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763228366, "uuid": "1987b6f6-ad49-4b53-8e9c-83857838f89f", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dce9879-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230550, "uuid": "e20156bc-eccb-4f38-a671-ed1345aecf57", "comment": "Malware payload", "value": "ea2d037418d50c2cd43405feadea3dcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230550, "uuid": "a379b873-d5cd-4381-bb02-0fcb24f81f0f", "comment": "Malware payload", "value": "dd3841fed92e7c6650c939a3c42ba918e0e930034f2a623d11b7959084a17541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230550, "uuid": "acddbc63-ef5c-433e-b2b1-877f48f093c7", "comment": "Malware payload", "value": "f2c32b90a55bd39d2858fd03055ded9dcf4080b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230550, "uuid": "8d03853d-7ce6-4aa8-9a5d-f6010471bd4b", "comment": "Malware payload", "value": "229f5dc28a988473f488dea4505a2f5bc1b248a52d83555c50275b7ca84d25b996636c7ad762b43d0cca5e445b4c8504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230550, "uuid": "04ea5a15-d049-4daf-9892-f25c15b7334f", "value": "T1FD85BF56A7F410B9E5ABC178C9468607EBB274550760E7EF03B0CAA61F237E11B3E391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230550, "uuid": "c2ffdc13-2c36-4913-b386-e4dfe0cc198a", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230550, "uuid": "c1e4ddac-d0e3-4c2a-961e-8ce111901ef0", "value": "49152:oEE0+ulQhSjDaAtKb46SCniJ614QeVH20vDs:oePTDaAtKb46SCGFVH20vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230550, "uuid": "ed7859d2-7ddc-45f8-b965-1d2454100154", "value": 1777664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230550, "uuid": "e205cf3a-139f-4f08-b1f5-7faa68029d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230550, "uuid": "07762997-e4c2-45a8-8836-249e9b8dc4d4", "value": "y95bhhc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa1166d-c239-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763221373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763221373, "uuid": "104afd78-fed6-4564-a14e-75231a603a27", "comment": "Malware payload", "value": "ea72cc1736b45ce7299805de9921b916", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "Tool.BtcMine", "colour": "#779003", "exportable": true, "hide_tag": false }, { "name": "trojan.msil", "colour": "#70173D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763221373, "uuid": "ddafb361-195c-495f-90d4-1add9ab7d49c", "comment": "Malware payload", "value": "de70cc178db918f81606bd74246449bba4504f6d316aaf9beed082f2000a9bea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "Tool.BtcMine", "colour": "#779003", "exportable": true, "hide_tag": false }, { "name": "trojan.msil", "colour": "#70173D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763221373, "uuid": "d9181671-6c27-48da-81ef-0a5dd96f4fbd", "comment": "Malware payload", "value": "18b217dc7e96a0e4e78f56258834cfc9ed79c1d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "Tool.BtcMine", "colour": "#779003", "exportable": true, "hide_tag": false }, { "name": "trojan.msil", "colour": "#70173D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763221373, "uuid": "da4e4d36-d546-4a66-ab14-fc0f9d39673f", "comment": "Malware payload", "value": "663afe077583df65aa15fe6ac00fcb79659b802bad655f0fa630026415231af981e81c4ce17c834c232f351e929f947d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL/TrojanDropper", "colour": "#CBCC53", "exportable": true, "hide_tag": false }, { "name": "Tool.BtcMine", "colour": "#779003", "exportable": true, "hide_tag": false }, { "name": "trojan.msil", "colour": "#70173D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763221373, "uuid": "59652c85-a6ca-4551-88ed-47149ee47766", "value": "T178848C0EA3152536C82C68F38E6B00F697B1922E763FE6650CE761477DE25F1311A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763221373, "uuid": "678ca169-c2f5-44e8-b238-044fdac7abe9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763221373, "uuid": "997126a3-f9db-4b26-b454-9ddb64cda4c7", "value": "6144:c+N4wI0++bCazRhXy8022Y2Ra9v1UOLaQZNpSw6+cxbtMEw75fgC/FDVY3Eu:JNWee8zyuvWsfN4nbtMVfrFD6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763221373, "uuid": "7a83dc33-9b7d-466a-a1b1-e06d5f8994d0", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763221373, "uuid": "c1df0016-cd9e-4663-9a33-dbabbcdd78ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763221373, "uuid": "1147c626-6db8-4ef0-9bac-0b99e6ad9a36", "value": "j.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d7b35f-c223-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763211743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211743, "uuid": "dba7ff35-0ba3-4670-bd46-fdf2dbeb2425", "comment": "Malware payload (Mirai)", "value": "4e06c1caf12bafe1fd67b1896e3b4fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211743, "uuid": "36a5224a-50a6-4ab6-826d-050c636ad2af", "comment": "Malware payload (Mirai)", "value": "decfbc16f8f5de7daed39bf83a8c97ef38f44f3fc2351100d20cb493b3ee9b8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211743, "uuid": "a4669e9c-710a-439c-8d36-61e43c3b819a", "comment": "Malware payload (Mirai)", "value": "1b1aa588b14632b1e8fc6eca7848cd54d554a77f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211743, "uuid": "82cf8e84-a751-491d-a80b-35bf51054fb0", "comment": "Malware payload (Mirai)", "value": "0d2893bb804a838a56e284774607e5ae9866d08abad383627b34f74980432eeec7bc608582a306083e3af37654f797e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211743, "uuid": "d9fc975e-3069-4dee-91e5-7cd49a1d23c5", "value": "T1685302F790E47ECCC1AA8774020F4A423E826378A15A6A36B6C4F6550BF1340DFD8BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211743, "uuid": "a0170eed-55a3-421f-abee-70cbd1e9aaf9", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAeN1Lkg4azHu:CM5az1Fy0oPgdZX6hTo8RdLGazHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763211743, "uuid": "5428d8bf-63ad-46ea-9b1f-4632edc62703", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763211743, "uuid": "1004401a-4aa6-4850-ba8e-cf2c430eece2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211743, "uuid": "5be900fd-f430-4123-a431-a55c5a26b074", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b842660-c1bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763167571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167571, "uuid": "00a4442f-b175-49f4-b577-1433c49ce7a9", "comment": "Malware payload (Mirai)", "value": "5031752623617a4da2ff10de2681d617", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167571, "uuid": "9ea7bba4-a406-4acf-b54a-ae43498eb6b6", "comment": "Malware payload (Mirai)", "value": "df968d1a7163d8a3bc054df36e29db6e59725db775bfe86778d09552d761cb52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167571, "uuid": "d8744507-59aa-4c0f-9bde-a142182c9f2c", "comment": "Malware payload (Mirai)", "value": "3fb98b65a3f744d93627bc91a894807f23c81144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167571, "uuid": "cda7acc5-7ae1-4dd6-923a-b4e09a0cddc1", "comment": "Malware payload (Mirai)", "value": "ef7068ccc91898bde339895d90f06322da63dc31594fa0d81a334153c8aaf49722d229815748320ff1128bac9b104b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167571, "uuid": "e1aff5f5-3a7f-4467-bfc2-3b00cf2acec7", "value": "T19B73AFB3D4269EA4C804517870B5CF791763784482B72FB7899AC2B6A08BEFCF1153B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167571, "uuid": "6ffb4090-d214-4603-a9e3-5342e8af2dae", "value": "1536:HJcy48wwijLiF1OSwCWQCjKQ0W3KMbCAYMUnN1HjSU:HJcFPwmlQCGQyMb4MCXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763167571, "uuid": "5e81345e-22b2-4ce7-b1f7-6569611ab839", "value": 74944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763167571, "uuid": "87aafb8a-271a-4be7-968b-93ed52d079fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167571, "uuid": "1ec2fded-82b4-4508-bbcd-7675e4fbc664", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b7e7ec-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240628, "uuid": "147cc50c-5883-4cb5-a707-10bb9d72b625", "comment": "Malware payload (Mirai)", "value": "e56387ab00d1e56f5315565a10180391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240628, "uuid": "3a7b9765-e820-42e4-a8f3-c5cf0989e6ea", "comment": "Malware payload (Mirai)", "value": "e3cdf51a06f0f08463d5d2988cdd5c85535557171c8217b4e9650a009ed3a4ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240628, "uuid": "149965ce-0d87-4425-bf4c-4a86b5bde5a3", "comment": "Malware payload (Mirai)", "value": "df259fdc6683df8bf7da61294b3bc816cef69e8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240628, "uuid": "2d529cab-1e64-4c9d-8e88-29fff99e0650", "comment": "Malware payload (Mirai)", "value": "5472ea1935ab982e398a63db339dd60e42d99922b9232e52f918ffb89cfe70b53475496206bee7910ef6d5ad7bebe249", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240628, "uuid": "26d60bfb-88c9-499a-8b36-62a76459b617", "value": "T1DC82BFD190595A40D7F005FBF23EC24FA9472AF8627A323B35B01928E296C436BB17C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240628, "uuid": "1d7f82f0-76b7-4ea9-b7d4-261c17bda808", "value": "384:hYUVhhu+fsO2iTN1/nsxY9qVpoqtb/vLSWUBs7DhymdGUop5hIb:hnVTNfcqNkSo1b/v2RKvs3Uozab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240628, "uuid": "fef71e42-7c40-4403-81cd-81858e4f9970", "value": 18572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240628, "uuid": "a16dfa9e-082f-4d9e-afd9-b1adc169685b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240628, "uuid": "39d2f68b-bc55-41b6-b943-14a85769f122", "value": "brichs.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9c388d-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241526, "uuid": "0594b3d7-9081-41ec-8a0d-aae8ba6bfcd6", "comment": "Malware payload (Mirai)", "value": "36e3640b82592e3e016fe01b19a3dac8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241526, "uuid": "234d7fe1-e34e-4be6-b505-1a4cf599a012", "comment": "Malware payload (Mirai)", "value": "e489b2d7708986566570ba14dfdfdc83c5d6774f276cd8370a6fdd2f0ad9e9d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241526, "uuid": "cbdace50-4fa2-4970-8a79-d961bd1db4d9", "comment": "Malware payload (Mirai)", "value": "b445e202a90e915a6b280b3a531f1e1f50b4211e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241526, "uuid": "ddefeabb-985f-41f8-a463-2a0e8ce34a7b", "comment": "Malware payload (Mirai)", "value": "6b57076374989be63ec596418478924e7cfd40d61125a1380e470b61c86824ed5be05a7fe39b0b6874e0852a8493f6b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241526, "uuid": "c52a13c1-b0ea-47c4-b511-5a833a20f2d5", "value": "T1D1733C42B31C0957C4635EB0253F1BE1A3EBADD121E0F689255EBFD986B1E321042EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241526, "uuid": "551edb5c-3fb3-496d-bfb4-5b556cf38f95", "value": "1536:TebJgJR+9PevYNo/UOWR5p5ZopC/KK0fLdddddddddddddd8tddddgddvdiDOu:YJgJckeo/yIpC5Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241526, "uuid": "7a609ef3-7203-4668-ba9f-561f4a9c683c", "value": 74928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241526, "uuid": "3b16702a-e1ea-4778-af61-eee0902671f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241526, "uuid": "cf71e7cc-84d5-4e72-b8f3-1493f9c5feff", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69f239c-c1b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763165523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763165523, "uuid": "3a8941b2-d7e5-464e-b1d0-052c0525fd4e", "comment": "Malware payload (Mirai)", "value": "9be74743036fe98f17a98538f458153b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763165523, "uuid": "3fab88df-190f-44b0-a4bf-feb102378d14", "comment": "Malware payload (Mirai)", "value": "e547e9e639a551e64960b74a64cb0349788150d454538f980cefe50e33aa069f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763165523, "uuid": "9c85f1f1-0c03-4abc-bb91-881d00004068", "comment": "Malware payload (Mirai)", "value": "10a96cf24448ee859042d071eaf9912e9e18f021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763165523, "uuid": "1cee0a4f-6bf1-4ff2-88f0-102c4496c7c4", "comment": "Malware payload (Mirai)", "value": "12b0bacf8ed77b751afe3204a8690ee1e395f5f2bb9d71f8129b57c5a866bf1fabfd7610fabf1fe92b521be476d74430", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763165523, "uuid": "1a9a1b33-c681-4236-a589-c0a8d55f7c01", "value": "T19A23F26C1616019BC06A837D5F7D6630AF355FA751818D9F0B32CBCEBE8708229E2BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763165523, "uuid": "ce6a8c45-f074-4106-84ca-d534985b05a1", "value": "768:Gem1mx8awHGtKIFnqIGuWQnnzcPQdxqI3I0U9YxUnACqTVV5bDXjJgGlzDpbuR1Q:G711awmEnIGu8QdoI3w5nACyVTZVJuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763165523, "uuid": "0ec09c60-9b5e-4d1a-89dd-48fdaf72ca67", "value": 46892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763165523, "uuid": "fbfee200-9fff-4a85-8c18-a5e3b95f7395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763165523, "uuid": "a0abcccd-0052-45b6-91dc-0924791ae643", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7aa4ad-c24d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763229795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229795, "uuid": "29f9bd36-0e80-497b-93c8-a96b8be7e6cb", "comment": "Malware payload (Mirai)", "value": "041b6c0b7bb77558b8a2c84350954d09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229795, "uuid": "be9dc86e-7afb-48b0-b71c-3880fb806baf", "comment": "Malware payload (Mirai)", "value": "e5b9b14bbee46a556b83c426ae2ff1333002d8af8a05dd500dd764338950cfcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229795, "uuid": "a38b4b4c-7ab3-4956-8d5b-568cb748d931", "comment": "Malware payload (Mirai)", "value": "dcc37477e76779af90ab374bf18b182578b911ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763229795, "uuid": "27f92952-c5f1-4903-9c4b-1290cae06bac", "comment": "Malware payload (Mirai)", "value": "54a079e88e0acf3d2df970238d4725236825e657ff4cfbc952547bf29045172a8da089ab59ec4f98dad72e2ab42b4c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229795, "uuid": "a9e9c447-0c8e-4882-9bcf-0711811a93de", "value": "T1626302799087A9E7E72029336A1469C673B672BCD56F60C465488F2890B8921EFED4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229795, "uuid": "7088efd5-89f0-4e54-8b88-5a1e12889de4", "value": "1536:swGKIovJHsTaQFZXR2P71KULKI3smy4LK4fuOWYLe:sMIovJHs2QFZXR22x4LKcttLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763229795, "uuid": "32d14925-2f45-449f-94a8-ea03ccfc375f", "value": 69140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763229795, "uuid": "4f54fdd9-e47a-4a3a-ae1f-a34ca7644abe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763229795, "uuid": "05dff7fe-07bc-4867-8dc2-68cd01bfd46b", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6e328e-c1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763166422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166422, "uuid": "a57fc980-1b82-486c-ba01-78aadb3404d3", "comment": "Malware payload (Mirai)", "value": "dd7745c780be26c12288550426b25bc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166422, "uuid": "fe78f082-b610-44eb-aa49-6cedff5c66fe", "comment": "Malware payload (Mirai)", "value": "e69532d3d5e8d5edc2eca9efb9b0378cd20fca36bdb573fd4af7fc1a889b6d7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166422, "uuid": "728a0549-8a25-4119-ba7b-e5d09f2f0050", "comment": "Malware payload (Mirai)", "value": "c5282bd7737d281ecf6eb65b2f13e2a45e8a329e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166422, "uuid": "02bdf6df-6fcc-4d37-a5b0-34f6d6a8b037", "comment": "Malware payload (Mirai)", "value": "70f0652027d3e364927810f5a2c6c5ef0e25bf06428cf1e3687988f2df0005b94cbeb3d21f2cdc8f10e3a00519583358", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166422, "uuid": "92a18028-1909-402a-b9f0-189f58243f83", "value": "T1EB6302230B0B2867F1E64CB969B1078538650B31B8FBF07AF681718DAB570556F85E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166422, "uuid": "0996e452-f8c0-405e-be1f-5ce87f55997f", "value": "1536:nP40xkUGBptKLMesP/SYNWEu8Nxry5LMA2H5f9oW+XXOcm:nPDkrptLSAJ3+5Lrw51kXBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763166422, "uuid": "e524bc06-0fbe-4f7e-8e62-ec1ff34cf7c4", "value": 71264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763166422, "uuid": "dd147199-becc-4a96-84f2-70a40197ad8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166422, "uuid": "11eea5db-46a8-4b76-a0b5-619a53522d04", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9d03bb-c27e-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1763250731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763250731, "uuid": "c877e1e8-5f49-45bd-83ac-b29c1de5cb83", "comment": "Malware payload (njrat)", "value": "6b3ece7d3ea9cc5fb1c67cfe5657e05d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763250731, "uuid": "57d1aae8-6b51-4471-a5ef-c70835df8de6", "comment": "Malware payload (njrat)", "value": "e6a5b25f6908df2812d77e1b071f71002eae1c6584da91bbb571d073c2ec2c6b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763250731, "uuid": "d5f4671a-de17-4016-a385-1787475e6518", "comment": "Malware payload (njrat)", "value": "8a0a359d94e7a246ac512b5f3ab961d841f77b73", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763250731, "uuid": "44bab537-25ca-4082-b895-3d66f09a4155", "comment": "Malware payload (njrat)", "value": "360f2c0b8f7b53370cb7364fc21e762633304a0781c832ffc950a36f4df487e022194aae9d842d4acc26ccc351dcba0f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763250731, "uuid": "c10fee6a-edde-4a3e-b23e-2cb8b89e7d8f", "value": "T14825D09573F4860BE1FF2B75A47248490BB7F5539936D74F0988A0AE1EB37808E117A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763250731, "uuid": "efa7a703-72ef-40c2-bc1a-52f5d703245f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763250731, "uuid": "095e0cf0-9b21-4b58-aebb-d571e39c4540", "value": "24576:iF/pVxJzck+uGW/yFoBkkAQrkx+BNrmgSA:iF/pVTYjqqanTrsgrmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763250731, "uuid": "b7d7a511-5d51-49c5-94a8-608967a45993", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763250731, "uuid": "494503be-891b-4845-98f3-62c148637647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763250731, "uuid": "a0b8f9f4-455d-4f8c-87fb-0576fc2ab7f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757837f7-c1f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763192902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192902, "uuid": "2aa7d7bb-8c08-4406-9a7e-f5432c239d84", "comment": "Malware payload (Mirai)", "value": "eb54087f1d2cbba0ca09213a73b87752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192902, "uuid": "a2de210c-3d4d-4b8d-a481-3fd84bf23fcf", "comment": "Malware payload (Mirai)", "value": "e82cfe586255f3077b94325161b0bf6cb6c247ce4856e5c1843e4d14bdd8334e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192902, "uuid": "039ab896-7612-4ccd-8847-170385900edd", "comment": "Malware payload (Mirai)", "value": "137a637690660e4ff7e5b5475484c49767e64ada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763192902, "uuid": "2f6c132b-e8f0-4353-9cdc-444f91fcc19e", "comment": "Malware payload (Mirai)", "value": "0b46d834c398329bb171602d0b7a5a6eecfb62507cd50c3a33d59567ff307c893063f1003138ddafe77bcb760e864045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192902, "uuid": "fcdd88b4-6d09-458a-9977-81af57919133", "value": "T1BC73A51A3E25DFADFB6CC63687B78E209788339526E0C585E16CF9015E6034D641FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192902, "uuid": "0d9934f2-3ffd-4713-aada-c7f75f4a552c", "value": "1536:fL/Q3wrWZonHqWDRlIfp606iqgpky/iCSjT9h12vPK2uybVRJ:LQ3/Z2XIh/6iqgpkEiCSjj12vC2uyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763192902, "uuid": "7e1df81c-8a24-4adc-90ee-187d39f6bef6", "value": 80128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763192902, "uuid": "41d6ed08-47cd-43a8-b237-4a4b62aea457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763192902, "uuid": "8da3e3ef-9d13-4b6f-b856-6c1a8d926116", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bc7c2d-c236-11f0-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1763220173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220173, "uuid": "5e9cb156-8918-4d09-9df0-cc20afc28811", "comment": "Malware payload (PureCrypter)", "value": "c1ba8db7eadb612e02467fdd8786a194", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220173, "uuid": "34777e78-a0f8-4024-b6e8-6f145d544f30", "comment": "Malware payload (PureCrypter)", "value": "ec0340c6a988fa791ac8ab7fa1a5aef67853f688913759cc2631e44de2ebbbd7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220173, "uuid": "9ba81260-e774-42f2-8c94-80e0ee885ca6", "comment": "Malware payload (PureCrypter)", "value": "422e82e10079feb861adfc8331a036dd22063d2f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763220173, "uuid": "910e5851-af4e-4178-813f-a12a71816033", "comment": "Malware payload (PureCrypter)", "value": "4bd68b8c7e6d96940ecd8f21c69203df51420f648169e26006d947134a9ec9d9aedd03a6a1aee1ec3cf5f5bbc067335e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220173, "uuid": "916f12d5-e014-4bcb-9819-85e84e570025", "value": "T1DFA63321A7C17E9AE08887349278D70B704693AFE19D5C64F58D91BB8F9FAC43F06C91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220173, "uuid": "2107d105-10b0-4f1d-89c0-d51daf1ba822", "value": "196608:o51QJGkJQTDuH9Qs0tEocVh6VQ4CcBCnFum7dOyUuE:o5qJLJL6EXh6VtsFum78uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763220173, "uuid": "e7138c9d-9306-44c0-a569-dc07c9e7462f", "value": 10221568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763220173, "uuid": "03b456e6-f88a-4c02-9d75-3fd940e4df57", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763220173, "uuid": "d8f48890-ee61-428c-8623-aeb074c1b51f", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c783a405-c24e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763230405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230405, "uuid": "9781b0ff-3f32-41ed-b679-5599465c5175", "comment": "Malware payload (Mirai)", "value": "b64818348560e7c3c2cad91ab026bee0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230405, "uuid": "fd941469-9727-4289-bcc6-031df7f3b605", "comment": "Malware payload (Mirai)", "value": "ed2d3166f56ffb26462c0bf8128e009689a115dabd50d9f4e0609bc1221fd395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230405, "uuid": "91f6636b-7957-4f25-8838-e1ddc8e7fd48", "comment": "Malware payload (Mirai)", "value": "1d8ac5f840fe0c415aa254b71d6aa9e0ee8c8932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230405, "uuid": "65a9ba9b-1809-4519-aec8-b3dc5d2a3a10", "comment": "Malware payload (Mirai)", "value": "f9965512d915d00238cfe83279b3c473f21c91d81de0c1ef85b6a17085d65124f4aef588c6e27c13c32d51c850cee8fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230405, "uuid": "2dc3af45-34c4-4170-8bba-09d32779fedc", "value": "T1DC242946AA814E13C0D627BEF69F424533339764D3E773069929AFB03B8779A0F63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230405, "uuid": "81c8d5e6-c2f8-4ce8-9b01-b8dd9aef602c", "value": "6144:S4K0fQB4OMdzS4MaXLcQYs1ffEsLN5WgCXM/RGZ1A0:RK0fE4lS4MaXLcQYsVs2FCc/8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230405, "uuid": "0e843d52-d31f-4648-806b-0d7b89f04568", "value": 228522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230405, "uuid": "dc08267f-925e-48bc-ae9d-72c7c0a6e5d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230405, "uuid": "b17cc103-f041-47cb-80be-6b3dd3f3706b", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af99d748-c268-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763241532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241532, "uuid": "891fd516-1831-4c01-a7d8-7b171d4a673a", "comment": "Malware payload (Mirai)", "value": "fa23dd3302e3b48c53eeb62e8e8a0d54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241532, "uuid": "7722e01d-2dac-48fd-8efd-ea07bccf17e1", "comment": "Malware payload (Mirai)", "value": "ed8fefaec32f423d47ad8929b6e8f869f3d7043245ba1e99ceacd75bfe3b5f2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241532, "uuid": "cf59b7e4-73cb-429a-b48b-f9d44dc00276", "comment": "Malware payload (Mirai)", "value": "564245f02c3e802cf242bbc73dfe35016e9cab5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241532, "uuid": "c28896f8-99ca-4d25-9cce-7469597bc376", "comment": "Malware payload (Mirai)", "value": "f2ddd570c627f2705c69281b047e73d428f86c1a6a53a15d0b7db75e86fabcc16c7fe3a3d26db80ac0d8d1d8368d4baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241532, "uuid": "c991bca3-472c-4395-adb8-4387e40af6d4", "value": "T11E030791BC824E66C5D4037AB67E16CD372063E9D2CFB203C9205B647ACA94F4D32ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241532, "uuid": "7442c488-7674-4611-9b7e-87efb8260df2", "value": "768:9lqGDqx8PFqTSzACk3mjzlmy0FqlxwBXel9CORh3Cglu1siwxPQQfv4owCxIfwW:9lqGDqx8PYCkKqE/nVhllu1rmQQf9xhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241532, "uuid": "c9754706-a54b-49a6-b76c-cfd299651376", "value": 38792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241532, "uuid": "c82e1e38-a33f-461b-9938-d42cd1745c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241532, "uuid": "53a0f6b7-0133-4004-b7a5-9b969988d63a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3176ae17-c258-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763234449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234449, "uuid": "aeb9e503-c988-44bf-86e2-caf79f52a78f", "comment": "Malware payload", "value": "046e524a7175dc6c2592ec40bc868729", "object_relation": "md5", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234449, "uuid": "1805bd47-c5ed-414f-b371-9609cc3423f7", "comment": "Malware payload", "value": "ef0d64f099058e8656da1ff85203e74eedbf3f5aca6442c6025e06b96e567077", "object_relation": "sha256", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234449, "uuid": "2d4bb8ba-5ac7-4e67-a540-5da1db58de53", "comment": "Malware payload", "value": "ad560dd697815dd6a15e3aa057de3e17c73fe868", "object_relation": "sha1", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763234449, "uuid": "7dee642d-8262-4108-a609-2dc8d7de6fca", "comment": "Malware payload", "value": "43b281aaa31a2a036ef0fd299fbe8c3ceda4de00acef62f414ca5a641c5a1eb1526fb69161d5cadcc730cd407439c327", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-106-122", "colour": "#19ED6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234449, "uuid": "86608cec-12be-434e-9001-89234aa06ace", "value": "T1FBD423E513FE4A65E16748B4DA93B1D03ABC2F32E7D6CB844B5040FE6056082B746E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234449, "uuid": "8592bd4e-8649-48ef-b0e7-debb60a8ee99", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234449, "uuid": "f5765333-1987-4eef-8480-e7b915875a61", "value": "12288:PkqjVnl36ud0zR/6CtQ9PUHIG8DPq7NSlDG8yKTzNgD6mNvFxnYAV7X5fO:PkqjVnlqud+/2P+AYNUG86DN5D3Vr5fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763234449, "uuid": "e0ee1d90-82cf-47ce-85ed-a705cc33f954", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763234449, "uuid": "8ef99561-58b0-4e8f-b255-cd72ecfc14c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763234449, "uuid": "5257f262-9c8e-4a2b-9457-f5a17594477d", "value": "FileSyncFALWB_x1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e7aa96-c1bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763167049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167049, "uuid": "ee0ba272-7022-415c-809e-54de16848bee", "comment": "Malware payload (Mirai)", "value": "343aed60e3046987a1442deedc367c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167049, "uuid": "516cdcd6-53a3-44fa-bcaa-8f10e95ac697", "comment": "Malware payload (Mirai)", "value": "f02f512d7e42b3e068e74ee8d50fe728e4f4aaacf06824dee341a23e8fb741d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167049, "uuid": "fcb8a6f2-5a5b-4659-b310-0f8cc2253604", "comment": "Malware payload (Mirai)", "value": "938aa13db387f48bcd1a23d9274de30f548aa44f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763167049, "uuid": "ee9239ba-fb96-4435-8ff6-8587b9c4a9b8", "comment": "Malware payload (Mirai)", "value": "fb115914592d87919954b9fd666edff9b1127fbca9661526bafae7251c2507350ef3cc6481d568d9eb6763e9234cc3a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167049, "uuid": "f819b749-b20b-4e36-98ff-3b2822f0e3e7", "value": "T1AF23F19C5542CA61DA61B831F19752C63DA062BD93AC72372F990CC8E7E3141DFAD88A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167049, "uuid": "c767cd7c-7729-448f-8456-2c03547c1e11", "value": "768:aITyw2N+5zl7Vp+Pbs5nKOd8sdfJaKAtz2BL9p3UlA0jga/64V/Stm+1BNsd9q3a:aXN+tl7r6bs5nKOWRNcRtKjgY5tuBWwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763167049, "uuid": "44ba9dd2-f0d7-40d1-aa42-1c9ec894d48f", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763167049, "uuid": "85e0a5b1-f859-4ee9-bae5-7d7af572cd2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763167049, "uuid": "2f3ae42d-7ea8-4a01-b8e2-959c04fdae1a", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d80653e-c1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763166152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166152, "uuid": "e1721694-0917-406f-9aa5-bfd4e0a3ee82", "comment": "Malware payload (CoinMiner)", "value": "553a37fbc56ced1b73fab467b68d5cac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166152, "uuid": "6d8d2184-ddd3-4b68-b087-2db25112025d", "comment": "Malware payload (CoinMiner)", "value": "f0dc05f4a1ab641186035edcf039b2cc2b301cdeedd041463093501605a9969c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166152, "uuid": "7a41a702-cd0b-4ef0-b469-92dad0722e16", "comment": "Malware payload (CoinMiner)", "value": "aaba401becf36091205b74d97433d4094b362a09", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763166152, "uuid": "8cef2d06-086b-4b29-9b15-cd5f674650da", "comment": "Malware payload (CoinMiner)", "value": "a531faf9a221162e54e5bab775b0073f55ae1a6907e5935eeccce3bab9cd6ab0e9d79bb0cc44d449a7231ee7d901568f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166152, "uuid": "455b0bd9-adb3-4e2a-b373-802463f0342d", "value": "T1E6065B81FC41DF56C5D42A7AF76E8388735307BAC2EA70069D145B3477DF89A0E3AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166152, "uuid": "b3663a1b-c2f1-47bc-a2ba-6f225c796a66", "value": "49152:NuG9HunkTL6MPf0y6X2EJCo4LFKp5sz3vtxanqh:NuG9O46+0y64NbvtxanQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763166152, "uuid": "28fc6e56-4771-4ef4-be92-827078bccdb7", "value": 3834028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763166152, "uuid": "f343fdad-0a4d-4692-8dce-7d25d0fc7bd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763166152, "uuid": "5b962998-eb2f-4d12-b63a-b0842afd2a16", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c56798-c25c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763236342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236342, "uuid": "5154faf9-0abc-4402-beff-d18a69a70b0a", "comment": "Malware payload (Mirai)", "value": "30cb149febdea925c7a959ba6d54b0cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236342, "uuid": "c97b6193-072a-415e-80a8-c4dbda9d89f2", "comment": "Malware payload (Mirai)", "value": "f1c38676d3067181050ab785b74852f03e27105f835bb76a9e194000cd3458a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236342, "uuid": "dcc5fe95-077e-4c07-b2f0-997cd61d1fd8", "comment": "Malware payload (Mirai)", "value": "aa4c61e7ec948a235a0b33b54ce8c08c79b7b584", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763236342, "uuid": "d666d008-40ea-4094-a71e-2e772d3d5fae", "comment": "Malware payload (Mirai)", "value": "02ed3d377de1d9ab07b86f2c09b3532e5308b755fea03802e410e2ecd5fc702943357f54e3b002e0ab9e68a3c5083585", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236342, "uuid": "cfe275c2-da28-4ecd-a16c-b0b5b4da1173", "value": "T18E535D4332184957D2A755B0293F17F0C3BFAA6021E0B7CA781FAB4A8676E335447E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236342, "uuid": "93d89e18-4bea-4f28-9159-2135688d4f85", "value": "768:yBLi8zSk6ScUR0DOkwq3N81t8m8XeFzSHgllGvlmLKyLNfFl315kquybVRF:yQ8GkpBy8j8m8rglkTq1Fj5juybVRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763236342, "uuid": "0baa65fe-4c30-41ef-951a-996a441470ad", "value": 62416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763236342, "uuid": "c600e689-2da1-476e-a670-4af2fc302885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763236342, "uuid": "40be38ec-0c1a-4e63-aae9-2adefa67582a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c76242-c209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763200707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200707, "uuid": "56bd38f4-9a4a-40de-9598-811cb1c94c1b", "comment": "Malware payload (Mirai)", "value": "0258581ccec91b7c0479603747767e34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200707, "uuid": "3f3aa18f-6a22-401a-8698-453c239533b4", "comment": "Malware payload (Mirai)", "value": "f3579d7c0b52942b2fd962000f45fcbff389db960927af606e9af9c7507bc0d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200707, "uuid": "42b53128-90eb-42a1-9fca-05b4056a7f0a", "comment": "Malware payload (Mirai)", "value": "37efbb7c20f1a242a411e5df394322f04b4b86d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763200707, "uuid": "2711acf0-7e63-405b-b952-393779969ec4", "comment": "Malware payload (Mirai)", "value": "1d3f1cb9a4ea0f60f1c4d0a5b8caf6c1a591315d1bcc16ed79b31e735bd58e837ec8b0518c20881ade241310c8d12f9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200707, "uuid": "95fabd2e-0f82-4413-8308-b6d441d8716f", "value": "T12793098678415A26C5D427BEFD2E01CD33272FB8E2DE32169D156F207BCA91E0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200707, "uuid": "8d5fcec6-aae0-404a-a132-0716ba8f44e6", "value": "1536:g2nSjzlOMEbN0GZtQnEg4UExACYDweyvHK/PkIL/ajyBnmyu4hJJZDYExDCOf7y2:7HwE8EkZzra2BmA/OQTBSYhiKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763200707, "uuid": "b141f471-787d-4bc0-ad4b-cb8460b0654b", "value": 91572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763200707, "uuid": "0c87d39f-16f8-4eeb-954c-dff1c2e40b5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763200707, "uuid": "6df60c21-0c0b-4df9-80a2-84260bb73464", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199c5b0b-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230543, "uuid": "0df4a823-87f8-4687-b8d6-150fa296bc2d", "comment": "Malware payload", "value": "ae68c740e60d61ec65715c5e4f3af17e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230543, "uuid": "b31ee511-2fc9-4358-852f-30211096ef1d", "comment": "Malware payload", "value": "f409b5e486e1db4fa2e0ef99251305e8982797158099881bfcea7a578cd4be20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230543, "uuid": "0756f7a1-b7b7-4a1f-9c37-4b242bbcf4ea", "comment": "Malware payload", "value": "66ee6b80ea51b760fa35fd7494f3123a6126b784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230543, "uuid": "d0129efe-9461-49b7-af03-d1bae0f58271", "comment": "Malware payload", "value": "6afc4ef83d4b82c16287ce9b100eb232fe3c20c7a0ca91139247bc00b4bf88d3f4ced8f7e4646a2c82a15f66eb6cb3e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230543, "uuid": "f5cd99b1-33d1-4695-afea-bf21003cf59c", "value": "T1E5B5BF65ABB030F8C56BC178C9635557EAF2F4551360A7CF07B0C6A62F237E09A3A391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230543, "uuid": "d31dad0f-d5a4-4e38-868c-ae91a163afd0", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230543, "uuid": "a6350a1f-7b53-4b3a-9792-d40c6a1be20c", "value": "49152:pcf13mS5Az6MuwHCjiDP4qI9h8KvFzVH20vDnj:p2Mlz6MuwHCjiDvCVH20vDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230543, "uuid": "abf9c7e3-af9a-43c5-a738-e43a7bcc3e17", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230543, "uuid": "fcf48ea8-ea4a-4cd9-85c5-0e8c699f7155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230543, "uuid": "cb64df12-4c71-4dc5-a1fb-5dd6d227462a", "value": "sknuc5tqy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78270eff-c223-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763211804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211804, "uuid": "ada00cc1-a9b3-4d03-b1a6-d6c401d46bf7", "comment": "Malware payload (Mirai)", "value": "5d6cc0de5d80fd25d26a0b2e11d7a83b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211804, "uuid": "20bca673-982d-4947-a994-ed0c9be7b667", "comment": "Malware payload (Mirai)", "value": "f4d4bd9dc6d037f2a7886959087f33894cf3666659343c1178af1aeb3c26738f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211804, "uuid": "94d3cf93-cd71-4cc9-86ff-dd91f36378c6", "comment": "Malware payload (Mirai)", "value": "67bbb8a0b206883e5401973a54756f8f6f7958cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763211804, "uuid": "ce891b8c-c074-4939-989f-489cdc2b7b35", "comment": "Malware payload (Mirai)", "value": "4da2241ad734068a45e521614e79b3b264e344c05d1aceed75ae63248abe91aca7b3180ce5a70f6c0a6518dfff45619e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211804, "uuid": "eae1e8e7-8b3b-4f83-bf42-9bd831b06b0d", "value": "T1CFC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211804, "uuid": "fd07e623-9201-4be5-9bef-6171c15594f5", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy4w:VoRNjmj1VGFVrRiyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763211804, "uuid": "79f504f3-ce55-484a-9c1e-04c74bb5ea3c", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763211804, "uuid": "61ba1592-3d09-4378-931c-2cc952eab57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763211804, "uuid": "79f6fa95-1c3f-468f-a2ab-25d12eba24e8", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36022ed-c201-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1763197274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197274, "uuid": "e8e80caf-e3f7-442d-854e-575e9edc5ec9", "comment": "Malware payload (GenesisStealer)", "value": "e6ea94c2ce441b8f790829f43ab76661", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197274, "uuid": "3d84042d-f4a6-4edf-9238-22fb1c8c4629", "comment": "Malware payload (GenesisStealer)", "value": "f606ca7af47c6ecc38a8ed0a8fd7e060c8c1bcad563185c8245e70516e5229d6", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197274, "uuid": "703838b8-b801-46f7-a488-6081df82dc5d", "comment": "Malware payload (GenesisStealer)", "value": "a0dde5c50e11627a77295b5e4eb8792a65379c27", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763197274, "uuid": "2220f28c-9c38-4a68-a467-b3147ca6ffac", "comment": "Malware payload (GenesisStealer)", "value": "d4a7184a7e959e93dc57b568d921b96584471b6390d180c6dbf102737b5ae486c5a5cd81ae62fdcb1874c978e62f08d9", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197274, "uuid": "7179e753-6261-40a3-9f06-71d0e6a911e2", "value": "T16328338E2B0F554EE5288FFF97B74B03BEB56E439D422417D611B88EB476B2C014E885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197274, "uuid": "d397ebad-3385-4601-87b0-e130e0909d2e", "value": "1572864:ByzT88LByZbsZLeg8bh2wOcFRL4wYOpeKVzsx/E3+L51E3kE7UKRS6S4I6dhlI3I:B0T88L8bsxUbUtKp3zsxjbuUKRSsI2GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763197274, "uuid": "e5d561c0-fdab-4449-9fef-2986985cdae2", "value": 99037184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763197274, "uuid": "3628caae-8461-4b6d-80b9-bba79455b5d7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763197274, "uuid": "26e526ac-3194-4824-b2a7-731e30f1f1d5", "value": "Verse_Loader 2.1.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198eeaa3-c241-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763224530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224530, "uuid": "e98acc09-39dc-4e47-810c-610de6398b93", "comment": "Malware payload (Mirai)", "value": "bc1d2b4801efb2f0e0894569a021be8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224530, "uuid": "1c496915-e7bb-4fc0-93d9-3073f0c4cabf", "comment": "Malware payload (Mirai)", "value": "f66537d3385f10a4cad399d3dbaf65d8e1305513d2b41799ecd435b891cd8365", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224530, "uuid": "8429895f-e968-4acc-bf17-6f5c511ac9af", "comment": "Malware payload (Mirai)", "value": "e977344316dae8ca559fd1e6cfbc9190eb61909b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763224530, "uuid": "5452ff3b-79a1-4bc3-8063-dd59a505c86f", "comment": "Malware payload (Mirai)", "value": "3d3d39ba4bd388c9ca684c65d2f85d6977426fc18ff49d3ce24c17bcaa205c53c0366a64d291ac40224accfee5c4a7b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224530, "uuid": "5d956c15-d4fe-4477-a5a9-b280b2281cb4", "value": "T194C36CC4E68FC0FAE85615752072BB369A72EC3A203DEE83D3E99A219C539C1D51735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224530, "uuid": "36d1ba26-10ce-4ea8-8ec6-1bd8e8166fbb", "value": "1536:fGn5yeLbF3mgy+rpZBdfxqrYCeK+yQbOoEpzcyXHbnx5aWbI1B03PcShHyA:fG5JbFZFrpzBxqGbOHgYbneWk1qZcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763224530, "uuid": "0de5ac53-2784-4e8d-99cf-09ca004f3d74", "value": 129388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763224530, "uuid": "423eefd4-2ba7-48b1-a036-ea7cb38e6cb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763224530, "uuid": "0868d9d0-704c-474f-8067-93c9d024b259", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e122681c-c264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763239897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239897, "uuid": "af2f0771-41ef-478b-85d6-b3b93582def4", "comment": "Malware payload (Mirai)", "value": "f5a1feac2fcec611586ad7448568103d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239897, "uuid": "7543a7ab-d69a-4422-bb02-89f9deb4cfb7", "comment": "Malware payload (Mirai)", "value": "f842984998c03715d9f98a45d9507a1ce36bea372a3dcc140cf3e06e38189289", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239897, "uuid": "ede30fb7-90f4-4d3a-9418-a0e240b9b0af", "comment": "Malware payload (Mirai)", "value": "b096f0293b44dfe4b2438d9182e38852ea2aa509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763239897, "uuid": "2f541e42-8565-4c9f-ae83-7daca621ee8b", "comment": "Malware payload (Mirai)", "value": "63370afb04890038556631c898ce1a4820a3b5290fef72c9301097f89e37f6d773226eb1c33e196730334def6ca0a37b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239897, "uuid": "c6e9f616-ab82-43cd-84ba-26b5e9ced22d", "value": "T1C5F3D60E6E25CF7DF7A8833447B7DE21966837832AE1C546E16CD7105E6028E245FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239897, "uuid": "db9bb1d8-f958-4436-a44d-fa4337a73d54", "value": "3072:89Ar7T2y0qDZ/jqhJJ6TvPFY4LUuohgJk3DbMxkIsIZpSkrpQQG9jg9/FZ/NKGVo:89Ar7T2y0qDZ/jqhJJ6TvPFY4LUuohgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763239897, "uuid": "b581488d-2572-4d17-b44c-20414ca2c078", "value": 170796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763239897, "uuid": "3e36e3f0-9fdf-4a0b-89a7-dda2e1a4536a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763239897, "uuid": "5fb8edff-59d1-427e-b5ea-eac6b919f051", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b16be4e-c1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763186737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186737, "uuid": "f26544f2-9637-4c84-a324-824d08c10a50", "comment": "Malware payload (Mirai)", "value": "9a82b71fe9214ff682c6544952ad2026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186737, "uuid": "1ef5afe7-c66d-4757-8371-23cee9acb3d3", "comment": "Malware payload (Mirai)", "value": "fb4fb023aa4183f7643180ac780bfa7f06b7efdca3945d29abd042c635d23700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186737, "uuid": "715caa66-8821-43ab-8789-83ca735c8e28", "comment": "Malware payload (Mirai)", "value": "d837b0a2da2cbc6e9c00d8d5ece8b4e46c1392f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763186737, "uuid": "198edacf-12b4-4933-94b6-d2636f81b664", "comment": "Malware payload (Mirai)", "value": "aed4248891ea7a72199e97abc996c19e3c4324dea0e576a3d0617cbc3956411484ee290047ba99bea8292c0c8a3bf2b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186737, "uuid": "bdb61d2a-7498-4a40-a877-123e6a8b173d", "value": "T19F142B46EA814A13C0D727BDB6AF4246333397A4D3DB330699286FB43F8675E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186737, "uuid": "b89a143c-4645-416c-9dba-b766e58568d8", "value": "3072:+MAMMPNr0YP+Sa0SETg14/q7o1JCHho0pMO3NOpM/9qv/gys:+MAMMF2Sa0SETg1Kq7yCBoYMO3NMM/9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763186737, "uuid": "258fc0d6-930d-489e-bb75-d5d99d1460ef", "value": 196025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763186737, "uuid": "7d21ac40-9f41-418b-af87-bf82a215c569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763186737, "uuid": "d557ad8f-24bd-4df5-bcdf-03dba85466d8", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a319e9-c268-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763241346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241346, "uuid": "ffddd4f4-56d2-4fec-b344-c28aa776d6f3", "comment": "Malware payload", "value": "cb14e9bf9f9efcc1e92689a87298f6ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241346, "uuid": "35faa78f-24e0-4f87-ab2a-eaa59dbde078", "comment": "Malware payload", "value": "fd158c0e2d537cf8f335e33f6c2e150f3aca5fed362bb273326a504cec8ee4d6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241346, "uuid": "87a5ff79-2899-4480-8348-0e58f620ea09", "comment": "Malware payload", "value": "a196571130452296bf5e8e5cdb87c6114726d8e8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241346, "uuid": "e8e497bf-1a52-42bb-919d-be922a743970", "comment": "Malware payload", "value": "d79ceff4250e1266b71740007513261bc3221b9df7ded73f6089870ccd3538dfb1c182ee218d4431844ae2b3a0cfbd4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241346, "uuid": "117c1efe-f940-45e4-80a3-d4ea3e6632b9", "value": "T1B201ADED29D113790564CF586066C4D870058EC534611F5DA8CE2FF2A9D9F19FF12E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241346, "uuid": "b51d4771-83a7-423e-ab27-2e67d9e6d8fc", "value": "24:HbTXb1NI7pb9KQbdGbBvbjUbgMbRtXbMbTubS:3MXJET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241346, "uuid": "d86f26ce-2b32-4251-bb30-fc811d0afd94", "value": 814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241346, "uuid": "d1cd1f13-c2f4-4ace-8581-5e382ccc24ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241346, "uuid": "4061c69f-e973-477e-9001-87247ec746f2", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98076cc0-c266-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763240634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240634, "uuid": "51714f9f-9b9f-4e75-87b4-35815d3a3321", "comment": "Malware payload (Mirai)", "value": "f6c98327537db172602c4e6e1e39efa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240634, "uuid": "c9ce3a2e-935f-46f7-b1b8-e027b002fb7b", "comment": "Malware payload (Mirai)", "value": "fdb9f4c75a5b326598596bf6a1fb1d72acb70ba0ad93811cf90f7c45585411ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240634, "uuid": "94af896b-2043-487a-a6dd-e6291ccbbefd", "comment": "Malware payload (Mirai)", "value": "6b6edd317671fc1d4228a186fab1cd63a38dd6d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763240634, "uuid": "acbc6b95-61d7-4ee7-9d83-00989a916820", "comment": "Malware payload (Mirai)", "value": "874d19aa8fa5c0a4240829f1a7fdca8f43c04a7021fa46d01c03e0970c23c8ac992306c0c5b42cc005bcf6ccb1c40470", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240634, "uuid": "be4b0220-8e47-464f-a4ac-0c8431ab79c2", "value": "T1EF336B31E029CED4C5560174B4AD8F361F03F1C893536EBB1AE646B5A8539A8F609FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240634, "uuid": "29a6748b-86cf-4453-a7b3-01fee28bc32d", "value": "768:Vab1egrIqUWeFtjhLrYSU4fCatGvzbK9QFIoCvovjc4XCuqw:VaB6mcjpS4f3e2oLvFXCuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763240634, "uuid": "e42bd850-0051-45b5-ae5d-fc9e4ef42a73", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763240634, "uuid": "266f1cdb-a2c2-4088-950f-7737d3baee9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763240634, "uuid": "4250b223-08cf-4096-b753-d1793df1b2a1", "value": "brichs.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5169e03-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230804, "uuid": "6f476ea2-0640-44e1-9800-fbe14ffe26d5", "comment": "Malware payload", "value": "7561e1a27b2d1280348927f296d77436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230804, "uuid": "3a89ac5e-a585-49cc-90e5-945551cf56c4", "comment": "Malware payload", "value": "fe7154a9ca99cc28bcff9e89a33847b15982835d20b1c36fd3c92b4dcf6fe47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230804, "uuid": "6fb8f730-4b23-4028-a9ec-d7035a1b730b", "comment": "Malware payload", "value": "ddb54387623bc29425c5a9413fc518cb6a40834d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230804, "uuid": "74b40af7-a67b-4da7-ba9b-9b3ea9711556", "comment": "Malware payload", "value": "13161bc775aa7f4fc678ac66061b17d5d52a109ae90e92f87d3554ff028ca52e94cd664dc0d161cb113af07ceb3f7b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230804, "uuid": "063041e7-c81e-4933-b4f2-0ed985d323fe", "value": "T1D1B5BF65ABB420F8D56BC13CC9734517EAF2F4551360A7CF07A0C6A62F237E19A3A391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230804, "uuid": "71d2c7ab-dc8f-4cc8-b34f-2f5a8a6fb875", "value": "3674b8fb50b4fb24fadcbf5429306213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230804, "uuid": "55d18e07-63cc-4280-8cc8-7e9b73a6433a", "value": "49152:lKf13mS5Az6MuwHCjiDP4qI9p4KvBwVH20vDvj:lgMlz6MuwHCjiDfxVH20vDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230804, "uuid": "11c9bf69-ce18-4397-a448-a34050263fbf", "value": 2309120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230804, "uuid": "31c00343-86ca-45dc-8c35-446e253a8a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230804, "uuid": "93ed5b5f-0a0b-4e21-bef7-ee83fa0d3073", "value": "gzdhqua.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9b56ab-c1f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763193507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193507, "uuid": "9e578d1b-2d69-4eb5-bfc6-28b6b28596c8", "comment": "Malware payload (Mirai)", "value": "11dbf48967883074b54dd0c318a82e59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193507, "uuid": "cc1bf467-a409-4e55-97d6-f7a1922c5380", "comment": "Malware payload (Mirai)", "value": "febca08396e68135292031622e87f5dc5adc2a8cab1bae76b7335244b5382a6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193507, "uuid": "cc940579-c179-4807-930a-141e1116dfbd", "comment": "Malware payload (Mirai)", "value": "52654e6b1f289a8b938a3f32e62a56eb822133dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763193507, "uuid": "231fbb51-f9ab-481b-a014-30336bae9507", "comment": "Malware payload (Mirai)", "value": "5f0ca43f2e7c6d797271591a830eebcf7f7a1f4a7db37cb72feb56769e57286968ee90a6a075526581a03e4c8aeebe66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193507, "uuid": "21c2f319-0a3c-40c6-bf61-5771b4ce48f0", "value": "T1AEA33C97B5C18CFDC095D03843BE7536DC22F2EF0239719B9BE4AE262D0EE610A1D965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193507, "uuid": "89dedcf4-ed1c-4bef-a707-a9ebc9fe135d", "value": "3072:xioWoTgtB1ZFJFT4oS4FldBV7q9HUdl8F7cnF7c+:xioWIgb1vJF4wXqmj81A1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763193507, "uuid": "5b26b52d-05a5-40b2-96d5-06d32a0e7aec", "value": 104528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763193507, "uuid": "da4b56a4-8326-4493-ada5-c70370e03fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763193507, "uuid": "85893c96-d8d9-4468-a62f-0291b2e07657", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd672e8-c268-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763241288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241288, "uuid": "5df38efa-6bb7-441d-b31c-742f540163d7", "comment": "Malware payload", "value": "6cc83c61a4e2677da656c98c5cb2bea1", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241288, "uuid": "932eb818-486b-4bd9-a84c-6104b4583fed", "comment": "Malware payload", "value": "ff569eec3472ca02e3a0c3092c538dcc587026d8808ff40c6bd0bbeeefd0612f", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241288, "uuid": "51328005-52c5-4cd8-ae7e-f9af49a771a5", "comment": "Malware payload", "value": "4daaa2024f01d746de6cd6a072ad159953020b9e", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763241288, "uuid": "b7253a31-48fb-444e-afbd-56d709c13050", "comment": "Malware payload", "value": "27a02fc02a2e40d5ba1ccce0d37c8a3123869a5ad87932b57706c3ada4d1b6a42753c8e7df7bf82aa241a1252a2f4bd0", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241288, "uuid": "bc09dc01-a998-4ac9-b0b2-5979a4ba684a", "value": "T16D260113E2CB263EE3694637C576B970543FAE50651B8CA396E0F94CCE39C601D6EE06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241288, "uuid": "46db31aa-434d-494e-abef-5f91a882498e", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241288, "uuid": "3de0a159-5a39-42ac-aafd-7c40d56b8c94", "value": "98304:hDbE2Cz///ZAsTHK4Xa76qEJrRh8ZPdoYIxLYqjmd1WbnSLr:hDbE2w/aAH02DlRh8wsqw1Wbnsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763241288, "uuid": "9c5c76b0-22c0-454d-ae4a-3ce164d77968", "value": 4445055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763241288, "uuid": "8c6812f5-df6d-4f9b-a673-0a57b442744f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763241288, "uuid": "f474e168-1316-4dc0-b505-657383e034d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ff288e-c24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763230797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230797, "uuid": "cb35d4dd-990a-47bd-80c4-947e9a235eb1", "comment": "Malware payload", "value": "a796254da7ae163668d53308db514599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230797, "uuid": "ca8a14d8-51c1-49e2-9091-3ab8945abad0", "comment": "Malware payload", "value": "ff69be28f79972d3d2563330cc9129d977b24a34ccad10c932d26e542005f2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230797, "uuid": "ea130777-8a35-48b8-9ee0-2b9bde4e4238", "comment": "Malware payload", "value": "50b9237c368a0a600301707a41675dca36603b3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763230797, "uuid": "c032f604-4943-4d94-840c-5dcd9a40bd47", "comment": "Malware payload", "value": "76cf82f6b93e7936197c243c587d40a66bf94ecde1345963218b921b482dd564c84d8ea63094acd345710774017f832b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230797, "uuid": "9f95ce84-4381-4f9a-a470-ea967bb3338a", "value": "T15CA5BF66B7B020F8D56BC139C9634513EAF2B4551361A7CF03A0C7A62F237E19A3E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230797, "uuid": "d23aad9a-c366-4ef3-bb3a-6de390a7f0c2", "value": "b5d61f5401f957a1fa7397e1c31a7f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230797, "uuid": "a825ebcf-3de5-4334-8354-3a777c9ee4a9", "value": "24576:1MWbfdvNJ0yMTA7uivx7jVy/AUayXLjakhdewPfy5JLCgxZ6FMkCCgx+l6IONflv:+WxvNoTEDx7jVy/AUayXSSgHjtvDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763230797, "uuid": "ddf68475-6a51-4b7a-a287-d6856ecc87f3", "value": 2088960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763230797, "uuid": "6ea8e0f5-7be5-4f57-a15d-e38a075b304f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763230797, "uuid": "b6d1be78-ccf5-4a11-9e7c-68a6ee9ecc4e", "value": "0iasgsxer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }