{ "Event": { "published": true, "date": "2025-09-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-09-03", "timestamp": 1756944182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4f0a2256-4776-4b70-8b53-ec98382280b4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17237fa8-88bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756900616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900616, "uuid": "205f1533-593c-48c6-8ca8-6eb000b73e23", "comment": "Malware payload (Formbook)", "value": "a9b5f0141e0f5528054596d28d1b4a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900616, "uuid": "2a936978-4567-4b79-950a-16e7ca23b426", "comment": "Malware payload (Formbook)", "value": "0002a2f7d00d1d6c5289a0c6915c6a761145586b191c03d6ae9320ac487c9ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900616, "uuid": "b87a72a2-5406-43f4-9cb2-dc7da95d5cd3", "comment": "Malware payload (Formbook)", "value": "7b4b3701cc44ab817e46415d5bbdcea2855c47f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900616, "uuid": "9df73f87-eef1-4527-a5ba-070ce5ffbeb9", "comment": "Malware payload (Formbook)", "value": "0dfca768333dbed8b25b86f6ba2f9cd8b22f8032d39031e13e37d3af7683885a067a1d0acce9643cf5192b2a57b436b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900616, "uuid": "7c0f13bd-8047-4987-8c4c-a4ec4f0e40ff", "value": "T1A745BF0273C1D062FFAB91334B5AF61157BC69260123E62F13A81DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900616, "uuid": "ce0ed77b-492f-4a20-906a-42dc9874c03a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900616, "uuid": "52bfc9b2-2d25-4e8c-a7dc-9ec3f9001f58", "value": "24576:25EmXFtKaL4/oFe5T9yyXYfP1ijXdaC+emMaa5z+kdhh:2PVt/LZeJbInQRaC+emq5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756900616, "uuid": "8fad5259-04d6-4405-9f72-94db6fed26af", "value": 1243648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756900616, "uuid": "9a2a5a3c-3f40-458b-861a-64946a0359f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900616, "uuid": "85426d3f-44c3-4726-9ad5-510c1b0d06dd", "value": "dj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ff3352-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756872054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872054, "uuid": "83d7308b-3d5b-411d-b14c-1bc3798dee58", "comment": "Malware payload", "value": "1e46472db10c50f1277238ee2eca981a", "object_relation": "md5", "Tag": [ { "name": "adobe-ms-update-com", "colour": "#4835E9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "skateboard", "colour": "#D99960", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872054, "uuid": "8e6113b4-2997-4d54-92be-e4cf3cde0cfc", "comment": "Malware payload", "value": "0007f644bdf6d894cfccd0a6c821255f093321a6cc9b3fd8441026290228dbfe", "object_relation": "sha256", "Tag": [ { "name": "adobe-ms-update-com", "colour": "#4835E9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "skateboard", "colour": "#D99960", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872054, "uuid": "d6e4c425-48b7-490f-b9fb-85354bc7d84a", "comment": "Malware payload", "value": "182864e31c7b716bcd8235dfa6ce64cdef9b15eb", "object_relation": "sha1", "Tag": [ { "name": "adobe-ms-update-com", "colour": "#4835E9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "skateboard", "colour": "#D99960", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872054, "uuid": "e251be99-ebe5-4ab3-83bc-33e0f4dd180b", "comment": "Malware payload", "value": "73dfe688b8960c7ba1100cb97577ea68bb13ee142caf033002b73d90f8d806b1e5a3b9824885fb0ffa13dbf7e27f29a8", "object_relation": "sha3-384", "Tag": [ { "name": "adobe-ms-update-com", "colour": "#4835E9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "skateboard", "colour": "#D99960", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872054, "uuid": "424baadb-f77c-49e1-842d-086a936731cb", "value": "T1C421307B5AA3E59822C0068234E8DEDA69841F36D54AF460A9DFCC46D2C41CF404B5E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872054, "uuid": "bca67f6f-76b3-44ef-8cc1-a63ef345315a", "value": "24:WJ00ua51zqaOJMZLw1EZ7vV8FxK4VibD+qXKC20t2xf32usUrGAjC0e:Q1aM21W7mHKhD+qX3TQRrJjne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872054, "uuid": "f6c4f549-ffb5-419f-b1c0-fac3883e2927", "value": 1122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872054, "uuid": "280a9c72-2cee-4fd1-8fda-63d37d0a5d8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872054, "uuid": "bb17a53f-dfe0-4c92-a657-64aa4cd035de", "value": "0007f644bdf6d894cfccd0a6c821255f093321a6cc9b3fd8441026290228dbfe.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d912e0ee-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (PurpleFox)", "timestamp": 1756923275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923275, "uuid": "b43318f5-adbb-499f-bcca-7630fe8a2ea8", "comment": "Malware payload (PurpleFox)", "value": "d7c79a1760f566777725df8efc9321fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923275, "uuid": "af6e8cde-39ba-4cb0-bff4-e0323f374211", "comment": "Malware payload (PurpleFox)", "value": "00c1314504b05c7fc7cc7280405f31165b9722c704520afef26aa88ff566b871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923275, "uuid": "2667424b-031c-4cf8-a75d-fb8b69c3256a", "comment": "Malware payload (PurpleFox)", "value": "9d15564c47ea7155945378828f7aa60f01cd4c55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923275, "uuid": "8b5c9971-b7f2-44e1-9312-ed7fa877f74a", "comment": "Malware payload (PurpleFox)", "value": "77512203c206fc0704d4049591cde42ebba856ce6b443791aaf72188f76e2a0202ec7a7782c97091dd5bcc7228703d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923275, "uuid": "9e8c5052-646f-4ae4-a117-14abe3fce2b6", "value": "T11B65AE591BA74266DB557779C8A6A6A419190F431F28C0B21E304E1EBD2334FFC23EBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923275, "uuid": "2d64b03b-70c2-4b7a-bd25-bf52d6f0ed16", "value": "323f9a588df3d5a4732f7632ec223efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923275, "uuid": "74192594-a33b-44ed-bd0c-bb2248c681b6", "value": "24576:F39WaOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN:598HPkVOBTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923275, "uuid": "6efb8cb8-2864-47fe-83cc-9ebb1a2252fc", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923275, "uuid": "b467d147-dffb-4f30-be5b-5a9ea17f4b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923275, "uuid": "7d9e5d94-38c1-4829-8ae0-16d69012b155", "value": "vvv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656cd07c-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929953, "uuid": "33b988c8-7859-4c7b-97a0-607e9b854a3c", "comment": "Malware payload (Mirai)", "value": "0d02f7ba60262832ea61e703b8394662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929953, "uuid": "eeb04254-af9e-4c0a-bdd1-eba1f44d1731", "comment": "Malware payload (Mirai)", "value": "00f343a5aaca34f5fc4ea4e75ea67805d998cd590f93b942f0f323da729335d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929953, "uuid": "35aaa42b-31a1-4c51-af2d-c99c82f5a384", "comment": "Malware payload (Mirai)", "value": "4126ebeb17763d78902e3684b9e180ec8ddbd0eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929953, "uuid": "d42519c0-55f4-422a-951a-939e8f730944", "comment": "Malware payload (Mirai)", "value": "367e8d0c1e11c207670edcca13f9656af55046cb815d6e2299414565b1b8bd4c33be7ea08991e1dc16685795bdef07c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929953, "uuid": "6ffb2477-f4a6-4a53-a252-2f646e70b25d", "value": "T1D4041A46EA414F13C0D627B9FADF42453323AB9493EB73069528ABB43F8779E4F12506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929953, "uuid": "5d992531-d2ba-4704-8e59-f86c85d15f5a", "value": "3072:qs+G9rXs9zrw6HiTiS+PaO1bVnTr69OaXCXdPdP6owM/Rby2+aOL:q4s9I6H5XPaO1bVnTuXCNPxbwM/RO2+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929953, "uuid": "834b496d-61b0-48f9-a445-2da9291cfda9", "value": 188821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929953, "uuid": "9bd09c25-242a-4dee-9e2b-59ecd7424b5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929953, "uuid": "06612488-e468-462f-a400-9502b2ed2525", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b2002f-88d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756911965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911965, "uuid": "46f432f9-c808-4e2c-b28b-8cc207cf4782", "comment": "Malware payload (Mirai)", "value": "33820a8f112b5a1259ce3479dbb0b52d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911965, "uuid": "27593f60-b096-4168-b155-d16237ced7ac", "comment": "Malware payload (Mirai)", "value": "0184935108765e7a88999d02e9f27071517d4780994ded9f268837c7fdba4b13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911965, "uuid": "c571d3f8-36f5-408e-af5c-77826a26b2ad", "comment": "Malware payload (Mirai)", "value": "4950f9e198377cdb70ae10701b62f21c9c8ca186", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911965, "uuid": "281d0ce5-5e91-4660-91d3-3021f871d22b", "comment": "Malware payload (Mirai)", "value": "0c467beee154127f9673244c0847a701d78d145a168537ede0b1717824fd559b89e234e730aed613286a6c8efb0ca200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911965, "uuid": "7e0d4c2d-6a66-4242-a135-ccb4061ba643", "value": "T13FE3181394795EEBC0869FB566F38AB00793AC510B530F29A22EDBF40647DCCBD84766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911965, "uuid": "b105cd76-b575-4858-b861-3186d1599c68", "value": "3072:rjcfjyOPsAEfy0t0MwH1JsYTA4meZ73NymDV0t5q:fH8e/wTtTtmeZ73NymDV0t5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756911965, "uuid": "e725eadc-98fd-4560-b113-09f012480d6a", "value": 151555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756911965, "uuid": "cdd641a3-42ae-4846-b00f-aaacd6655ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911965, "uuid": "55d43a6f-4a98-4116-a694-9da69665522f", "value": "test.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6732c2-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913300, "uuid": "c04f3172-b978-4c71-8a17-f5a6b989a284", "comment": "Malware payload (Mirai)", "value": "6836dac58a73d268d5e7eb183fe5d776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913300, "uuid": "a50ca95a-ea49-455f-a89a-4ca60f8a8c5a", "comment": "Malware payload (Mirai)", "value": "01a08a8b56c100f9661f0e44d613adf2a04bd82e7d0087a819d28350b63d0516", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913300, "uuid": "1b390ad5-4917-4025-a70d-84f3d90d65af", "comment": "Malware payload (Mirai)", "value": "b4387c04383ef7b96b70b696600e6e501975eba9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913300, "uuid": "40c2073d-1800-4a75-a8d7-7ba1fa8b2ce2", "comment": "Malware payload (Mirai)", "value": "b1a6c6955f69e0c81df1a2f4fec16d1949f61982f77aa03ea4841e34cb66588165ab458af2c9c4afcacc211f8f0a84be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913300, "uuid": "360bef47-03e9-49fc-86e0-03f9243b6305", "value": "T11CA2CFBCB6A96C30C3B19671DDBC1C0572174A7866F671711820CBA56ED320A33B89CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913300, "uuid": "2ff6d53c-c3c6-4fea-8d5d-b89172c8f0ee", "value": "384:Nfmu7YtXl3lZ4G6pIsCx5QQ3dqDYBMyLWNtV7duAvswhymdGUop5hD:Nf17YJl1ZrcSdqsewWNzJuAEws3Uozl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913300, "uuid": "07bac409-f0af-4ec5-8f08-34c681aab112", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913300, "uuid": "04656dc3-530f-48dc-a846-09659a476dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913300, "uuid": "b6422721-96f2-4f67-986e-b5dff6c2c020", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3faebe4-88c8-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1756905631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756905631, "uuid": "c0fc3329-08dd-4c5b-9ae7-70e663c0ed76", "comment": "Malware payload (a310Logger)", "value": "ae2e3b84244acdb9db761b6a6d155a79", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "alauddin--zhongyou-org", "colour": "#93BDAA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756905631, "uuid": "8ad26a87-ddc3-4bc2-a8ba-4a415ccfbb19", "comment": "Malware payload (a310Logger)", "value": "025c1d273e83a5e44c7a0aedb9eab452198e764b927d02463fa9c9c3bc0d3a2b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "alauddin--zhongyou-org", "colour": "#93BDAA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756905631, "uuid": "869b082e-ca5e-49e3-8d9e-3e02a37d8ff9", "comment": "Malware payload (a310Logger)", "value": "bb067dc35032dd948a59cdb70d902ef4ce9662c9", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "alauddin--zhongyou-org", "colour": "#93BDAA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756905631, "uuid": "d18fe408-96e3-4ee6-82e1-809ee90a1355", "comment": "Malware payload (a310Logger)", "value": "e24f9bbb4a00c035bba3cf80e5ff98920fb5bda2a40df19a696f57979c36e4313d5a7a68164633ef1fe6cb1428e396d9", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "alauddin--zhongyou-org", "colour": "#93BDAA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756905631, "uuid": "8c12ba92-3147-44ff-8da6-e6fabecdc2a3", "value": "T1F845BF0273C1C062FFAB92734B5AF6115BBC79260123A62F13981DB9BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756905631, "uuid": "4596d193-d317-433d-a162-93448d27ee8a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756905631, "uuid": "4fab4a4e-7f28-4ea3-afa4-71470f4a1a2f", "value": "24576:15EmXFtKaL4/oFe5T9yyXYfP1ijXdaYgd3/Zt/dag9sktfJ:1PVt/LZeJbInQRaYulN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756905631, "uuid": "b5aa88d3-9e30-4191-9169-ad63a9fed0ef", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756905631, "uuid": "2c3e589d-30e6-4868-96dc-0e58bd1c72b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756905631, "uuid": "affaad82-3ad5-4a57-88b8-2210e4949e30", "value": "new_order_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7260f551-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929975, "uuid": "2f2e3270-39e3-4a15-9c6d-4f538be82441", "comment": "Malware payload (Mirai)", "value": "4d7d9105142aebd98b774e66e95aebb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929975, "uuid": "c5f46248-cfe3-48b7-92dd-efbe6c52b851", "comment": "Malware payload (Mirai)", "value": "02e795405eacea1d81fd6f1eef2628992c9b267d2a86f0e4ba84240d3ce9b7b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929975, "uuid": "d3bc5d4d-e0ae-48e0-94bb-cd85c805ff76", "comment": "Malware payload (Mirai)", "value": "44d421897562b98c82ef418f667e8b21c0face82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929975, "uuid": "2464ab19-ed90-4d59-9898-dc9c29653044", "comment": "Malware payload (Mirai)", "value": "a3052c0865777f758850a45d44614f9cb5136ff8c8c8b04cf221d9ea401558a424e75fa538f4450abd594624e327d398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929975, "uuid": "33a42251-7344-4d51-9c63-f130c61114fa", "value": "T197234C41765C0E47C2A25AF4293F27E0C3FEE9A020F4F588260F8B468275E77518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929975, "uuid": "368769ad-e223-4349-9d0a-5eeb0af1dd07", "value": "768:lqkwvgVaz33B07Du4X9vRssRp6wtw6inWZV9C5AkjVqtVABUksL5W7yME9:SYVrW4XVh6wtw6Ma7wZB//sA7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929975, "uuid": "62aa4590-085d-4e9b-9d36-fa2f610a48b4", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929975, "uuid": "1ff56c29-4dd5-4a61-bd00-5dcad1b8924b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929975, "uuid": "a56c3271-2887-43ea-b10a-f6caae7a9cf1", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c05d7e-887e-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756873831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873831, "uuid": "028679a3-fa4a-4235-bc88-246f19781f6f", "comment": "Malware payload (LummaStealer)", "value": "1a39c4d495ec4971683612fb8c466729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873831, "uuid": "ada61f35-a6f2-4c11-9925-095406231df0", "comment": "Malware payload (LummaStealer)", "value": "02f7c016d7ea160bc1f997a7d5a94505be26de9853bd44457d2adb99e08539e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873831, "uuid": "a046c945-0962-4289-8ebc-6aa9a70c48cc", "comment": "Malware payload (LummaStealer)", "value": "1891562cb580929e8d50dba82895be69ebf78b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873831, "uuid": "31277146-f3dc-4ad0-8919-80fac3892c32", "comment": "Malware payload (LummaStealer)", "value": "30c3a64c0c1442f2261ef270294a2d9109e5cf4734b81c3c49df0bd2ccb1497d2c8971dbc5b88046c21ddd30131e87b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873831, "uuid": "aa77fd42-cf37-4375-8da3-fb6f493c7bc0", "value": "T1A545D018AC7590DAFCD340706F769112E533BD3BCB242AEB51E497512A17EED0E3A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873831, "uuid": "d99e75fc-ee3d-43db-ace0-0b6addb9551e", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873831, "uuid": "2a072142-ac52-4c2f-aa82-8713e0cc0bac", "value": "24576:7UYxEL+Rbj/0c9qx6rFdmJYPCJlMhaUdzt2DRkBw9vxqyAi:7UAE69t9qsF40dztsGw9vjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756873831, "uuid": "71f611c2-36ae-40ff-9832-4930a428f14e", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756873831, "uuid": "6fe3adbb-1098-4dbd-b624-795c91b8f8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873831, "uuid": "5840bf0b-72ba-48f3-a6b7-bfc97b1cb423", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38dd469-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756923266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923266, "uuid": "318a3d74-a4f6-467e-b181-341230df926d", "comment": "Malware payload", "value": "063f5ebac98979069bd1e458e74cfdbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923266, "uuid": "cd133a46-eebf-4b06-a49b-7583aea2bada", "comment": "Malware payload", "value": "02fcd45c1ccd124ef1af257362389346c99e7c2bcdf39293d13a17a54c9f6a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923266, "uuid": "24cabdf3-4039-4ecb-bf44-6150e09d274f", "comment": "Malware payload", "value": "a3825cacab9182b9e29565ba5f92403e3dba515d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923266, "uuid": "bad17d05-101e-4531-964e-13b9a06a624f", "comment": "Malware payload", "value": "27e051da8f3aaff4ff15094eaba877a3016a482af602739492fd654ee417a9af93e49488c20e3e4410bf6c3305af0bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923266, "uuid": "295efb3f-743e-4606-a271-c8de4db34d79", "value": "T19005F12977A64E90D7952F72D19F02304B20E252FBA7EF4E3E2953543D433B1A9852CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923266, "uuid": "e3b72137-1aed-4bdb-a1b3-61cef9890728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923266, "uuid": "6e8889bd-5736-45f7-9230-733e12ee0a1d", "value": "12288:OgLZx65vAQKj1mXs72P9pA1Q6s+LHNldjKEPph7R2+waBZnb/0hVaF+t5hg004u4:OYQ0KsCPL2QOLtTh7VwacQ+tr9yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923266, "uuid": "9b98737e-7536-4b01-ac43-e9619298b721", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923266, "uuid": "5e9f6e43-8d36-491b-b60a-89b5f7cd8ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923266, "uuid": "aa399ce2-6f6d-484e-b387-9e4a1dc60b08", "value": "fSjlNRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45234786-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866763, "uuid": "bc6422d3-3ee9-4782-8bf4-ba773eb5e2d8", "comment": "Malware payload (Mirai)", "value": "cd85db8ec0ad465b7ead0c580532c7e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866763, "uuid": "3e089a1c-1f48-4690-80c7-82e345cb6413", "comment": "Malware payload (Mirai)", "value": "036b2e61efb590e1d305157b07d9c6cefada23a0b98e303fb0b19ee1270696ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866763, "uuid": "0839cfcf-c179-4d22-8978-4dbdc46cd181", "comment": "Malware payload (Mirai)", "value": "3fc473f4c8a4bd16134967a818b5441964f17c06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866763, "uuid": "97280494-c964-456e-8252-e33ea796c509", "comment": "Malware payload (Mirai)", "value": "243577ed42e5d5394a72a7bd3f4863a794b3584bd30b41c7df24a93a6b0e6dcada7dccd6d254d886e2ef9bb3cc0bdc64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866763, "uuid": "4386289e-7ca5-44b2-9bf2-2c942da299ad", "value": "T189230880B54F85F5D40B4E3040A7F63FDF71D82A40709AAEEF59DF32DB67A429209299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866763, "uuid": "e05f4583-0931-4060-a396-f2ec9651cc35", "value": "768:5Y6KUkGYYjQnNIJMG21HFRGf8DcokyE9c74rw0C+mo/LbKYK8VpMF8x:fKUkGYYjQneMGOHFRGf8Iok04Pmo/PKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866763, "uuid": "4c079969-b01f-4dfe-846c-b769935ccbef", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866763, "uuid": "dea3b511-d3d9-4ebd-af22-e09e20d5032d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866763, "uuid": "0179f206-7866-46b5-879a-a95c3de6fdea", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07655b57-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872672, "uuid": "e6142f6c-699c-4b05-be40-ceff4bbd2c07", "comment": "Malware payload (Mirai)", "value": "05a4d9dc90ed9179f93856fea4fc5173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872672, "uuid": "3a73aeb5-809e-4e3b-a555-3f3266e98bcc", "comment": "Malware payload (Mirai)", "value": "04bd0493bf57aaa75154f5ae4194a3a17f02322bbcb621e2cfa5f72d9a7df843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872672, "uuid": "b18ddfa4-4b8c-43a6-85ee-866e73d02b35", "comment": "Malware payload (Mirai)", "value": "b258c7879e5712338e8a594c6f2c6d35c598a49f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872672, "uuid": "7217139e-835f-4060-90c2-5dc59869943c", "comment": "Malware payload (Mirai)", "value": "1cbfe7ebb71a23b3ae89f46539e8fc4b898bdc78d3315bb08486723731431b2b54db8ab4f582fe10ced0e63aa490e12d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872672, "uuid": "17e88da7-4fa2-46b8-b89f-6184128feb96", "value": "T1FA31FE9562D09DFCCC9491BFAE56431173649F80F0CB33A3921C7715BD2EE785C26086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872672, "uuid": "0a770ee2-d1d7-4e60-ada8-4c919a0e3a51", "value": "24:lpKGpa7Urz/jlfLnXK1hcVev3gRGH9iMPBBukbXlxrR+zHGS90t:/KGpa7UrLZYnzpBukbXlxrsHGS90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872672, "uuid": "5f9400d5-af6b-43af-84b7-7c6f1df37a7a", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872672, "uuid": "e2c8f626-715c-4c79-80c6-76119f95cfc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872672, "uuid": "57e71faf-ef5e-49ee-ac2e-85363d64f21d", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb0ff47-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1756891821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891821, "uuid": "b755273d-e712-4131-8e22-c63367522151", "comment": "Malware payload (AgentTesla)", "value": "0c43b89b20d668fe549281a621ea4e1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891821, "uuid": "7e15c0ab-203c-4cad-b960-f5059bd6301e", "comment": "Malware payload (AgentTesla)", "value": "050f48be2fe4d6be9d7d2d89c861d94f1ece46ec5b244e05c9f20f9e40b44e76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891821, "uuid": "b9c7e488-e394-4c1f-807a-60ec0d42fd9c", "comment": "Malware payload (AgentTesla)", "value": "cb316e7e5e7bce0ceebf399ace4a545726aa3dbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891821, "uuid": "782e26ca-21aa-4f47-9c4e-43a58bbf538f", "comment": "Malware payload (AgentTesla)", "value": "3c681a7bcdd0ac989cf4aaf456cf12f9296facf2230747c05cff0e609d0518af897439a2b594edd6de8905aa69cd614e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891821, "uuid": "a62854c2-a929-46ea-87f9-b08ccb461eae", "value": "T1DE51A7443E8171821B6392A70E2B480AA126DEA1F21A875DD131B1DD7E5CF21CBDB630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891821, "uuid": "f2fc7e18-5145-4b47-a33f-9530f6912968", "value": "48:qmGxzjjcZyiLXtsTEliazvwUtU3CKWfCwENLfXy44saVyh7A/iMpfiB+sYXKUBe:8zoR8mzZUyKlwXsaVs7AaMpfY1YXBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891821, "uuid": "0db2085f-c7b7-4792-8179-0576c239d97d", "value": 2934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891821, "uuid": "b888d8f4-513d-4ade-bcf1-14fd69adae1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891821, "uuid": "9ef0d5d0-c161-40e8-859e-d9c725d2b946", "value": "Order72717.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b473272-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872679, "uuid": "256c1d4f-637a-4f76-8c26-61cef6199fac", "comment": "Malware payload (Mirai)", "value": "e8701610f379ad818c79568fa3cb31d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872679, "uuid": "87222c83-c692-4d84-95a3-d092a60c25b4", "comment": "Malware payload (Mirai)", "value": "05960be79c3eb648827c514c35c99134cda8f4e280fa39f70a7b98f5af43739b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872679, "uuid": "1687b3d1-fd6a-4c7d-ace4-d46fdd439d99", "comment": "Malware payload (Mirai)", "value": "3c8e7bc8ebc53066c7b1c1d1847c4a3d55cb8839", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872679, "uuid": "5194036b-838b-4c9d-80c5-878f74a57063", "comment": "Malware payload (Mirai)", "value": "d95ef84fee7fa041c8b9d3b689170dc2445b2a45a4ba67b46b52088dfd86f050f827c0510a0932aefe55e7107914a8fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872679, "uuid": "1507eed5-10de-4eab-b7c9-8b8a3cf6731a", "value": "T1E414C709AF950FFBD86FCE3702E90B4529CC655722A53B363674C928F54A90F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872679, "uuid": "efe5cbf7-fb10-4a7b-9d5d-9edf298f5a8e", "value": "3072:iNoSqrtuMDI9LRveHrTA5v+PZ9PHIn8o+ze8Sb:XtuM1Sv+bvJRzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872679, "uuid": "e2e43a0e-c5c7-4559-8286-fa6b10a236ae", "value": 207484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872679, "uuid": "f95fbbf6-2d60-42a6-8510-85049251abf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872679, "uuid": "57d3a764-0cd0-4d44-a050-691a69031914", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f844a98-886d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866297, "uuid": "9835c979-1d21-4c7b-b0d8-c6cb7e70f93d", "comment": "Malware payload (Mirai)", "value": "5ea6485673aa016860e93903658f99d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866297, "uuid": "f54c3453-bfdb-4a00-9c53-42bb044646ea", "comment": "Malware payload (Mirai)", "value": "06dfacf4bb22758e1743be816e982b9af64da11c4889ecf68009469a5e5b1b67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866297, "uuid": "d160eeda-9fbc-4a72-9760-71163adced46", "comment": "Malware payload (Mirai)", "value": "81c9ac331ea5e80ff50f47d797789453491e35e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866297, "uuid": "edb50f39-6090-4f6c-b30f-19aadab53ceb", "comment": "Malware payload (Mirai)", "value": "e71e391432b1e5742fa9ce6baec287de40ce80c61391d2cecf40fd2ace87abe843a1339db2f28a6d5b29ec64ee36b056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866297, "uuid": "d34b060a-40a8-4a1d-8af7-4ebe4101e745", "value": "T164F32956F9419B11D5C152BAFF0E428E73231B78E2DE72129D24AB747B8A87B0F3B005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866297, "uuid": "a1947aaf-3e43-4deb-aff5-2d5b3dd3e5ea", "value": "3072:zJdlWIWvydK5+4dHKEMRUKEB1Wt9fIu/aLdrJvbEa8slFRXt3kNfRdZbs:zJdlWIWvWK5+4dHtMRFeWtlIcaRrJPl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866297, "uuid": "656140d4-d8ee-4eac-b094-79e6588a3a24", "value": 170836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866297, "uuid": "f145a5a0-10eb-4a77-87d4-f9459de8d55c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866297, "uuid": "9d193664-ba55-44cf-a13b-66ae4950d832", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535ab122-88b4-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1756896852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756896852, "uuid": "6d17ad91-168b-4aee-83ef-00b5b69ddf36", "comment": "Malware payload (RedLineStealer)", "value": "00b48eace94aedc76461c2bad9773fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756896852, "uuid": "be2ef7d5-cc72-42f7-981d-084e68500c46", "comment": "Malware payload (RedLineStealer)", "value": "087d88e3175f91f7e9faa287f4c891b367677f61bccfbaf8b75b7e5825e84aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756896852, "uuid": "379ba1e8-245d-40b2-b875-56fba14b13e5", "comment": "Malware payload (RedLineStealer)", "value": "1bbff6fac6dc62be3f392ba1309e2646dd9fab4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756896852, "uuid": "162f6c65-540a-4a91-a108-5b4eaba369e1", "comment": "Malware payload (RedLineStealer)", "value": "5159f89206a0b08b93d52536697613041758807bf486769249a7fcbaf102fe396b28573d1f4a0bd38c2d7e2dace7eed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756896852, "uuid": "ae4a6ce7-7acc-4fdd-a9f3-ba04595c17a8", "value": "T1A5051295626ACA13F0B257F59DE1D7B467BD3FEAE810C3134AD96CDB3832B801590362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756896852, "uuid": "e0d25f47-92e3-4bf4-ba67-1054b3bee66c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756896852, "uuid": "a818e5aa-1c1c-408b-b6fd-376d6db63c73", "value": "12288:Z8m0OW3vicLfnmru6TSKMqb8k52Y6Bi7SZcZ9XivnGhkKDU3mg5K3d:ZCvicLeru6+Qbr2Y64GZsXi/EkKDUod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756896852, "uuid": "86c95788-71f9-4768-a419-f22174b8d6da", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756896852, "uuid": "5f013f12-9cbf-418a-a07c-ebebd9927a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756896852, "uuid": "59d6453e-97da-44ff-99cd-61516236a2e5", "value": "RFQ SA_PROJECTENQ_0090456.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4c7404-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756891689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891689, "uuid": "5d5ebcbe-4fef-448f-86d4-2a1376ead944", "comment": "Malware payload (Formbook)", "value": "a831e81b2b74203eabe8285ee1509000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891689, "uuid": "42ffeaf3-68a9-4f93-a9f7-288d999af541", "comment": "Malware payload (Formbook)", "value": "08b026f7abf7574f2c01bdfb97e78b406200a874f2638298c489155b84fcb1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891689, "uuid": "7d7f766b-feeb-445a-8575-3a12fb48eb5f", "comment": "Malware payload (Formbook)", "value": "d842e9be62d01d895ec527b12b23aba9bdba159f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891689, "uuid": "5fdd9330-b8cf-4262-a60b-3e13eb0a951c", "comment": "Malware payload (Formbook)", "value": "6041331d8b6c189f0db952811ed368e5bed7dc2641eed69360d6a13575dd191ca55cd13923ba98c9eb3b43128a82f10f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891689, "uuid": "a6ff5553-d4a7-4d32-b1a0-a912576ace5d", "value": "T176F41299274AD102F5F65BB45CA1E3B513BE6DAAB831C7034BECACDB3836B007550762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891689, "uuid": "18e2783b-7197-4056-bfdb-98d3daa67754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891689, "uuid": "8735d1a5-aec7-44b0-8852-d0cb9cc3b5f0", "value": "12288:L8x0OW9ZlGP2IJ0ODsJRC1NU0KMky3mMXZmrbVxZn9djx+:LZZlM2IJ1sKjaHuMrbVxP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891689, "uuid": "b1c777ec-b843-4f14-b668-4b94212b9abf", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891689, "uuid": "8e696dd5-df95-4666-99e9-98f38c04f7ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891689, "uuid": "51c0c05f-1f7d-4fd5-99e6-ee40d19c4964", "value": "Halkbank.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99675312-88c7-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1756905130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756905130, "uuid": "fd285f9c-6a80-47bc-911c-8e2f2341fa7a", "comment": "Malware payload (SnakeKeylogger)", "value": "75e6490870a6748e07c4c4e00e383782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "info--abimbolaconsults-com", "colour": "#AE712D", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756905130, "uuid": "6cec8715-7306-4e40-9c52-820b39cd4ad3", "comment": "Malware payload (SnakeKeylogger)", "value": "09197780e4de9aa1abaa44d580b3102138c6d3a03ab46b518f88f8c40dc882df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "info--abimbolaconsults-com", "colour": "#AE712D", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756905130, "uuid": "2cade7e0-7e60-4f92-bbf4-8339de556b7d", "comment": "Malware payload (SnakeKeylogger)", "value": "50266805e1d23e7d2154e053abca9988f9586298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "info--abimbolaconsults-com", "colour": "#AE712D", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756905130, "uuid": "8cbdaf97-512e-4ba7-a9e0-1ac783cb3230", "comment": "Malware payload (SnakeKeylogger)", "value": "eae8bf43f1489519c02309d970f8170fe5c56b570beb319e4e578e0ff3acc5d986c08dbf127a75491f5048f4e1db6ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "info--abimbolaconsults-com", "colour": "#AE712D", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756905130, "uuid": "99b8d690-07ce-47ab-a87a-598b7b789c35", "value": "T170F4CE9C3251B59FC4A3C9728DA4DD74AA207DAA930BC20390D71DAFBD0DA979F141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756905130, "uuid": "43c6c4d3-fe68-48ac-9d65-3c05e2f5d12d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756905130, "uuid": "f2db12bb-0856-48bc-8716-7b02a38c626c", "value": "12288:Q6l0OWEb9QYcObQKgOie19lXoztRF3LNa+6BOTxzzky7mf9THWwGFVfbJovBDs:Q1YZbQfLQXmjFM+6uky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756905130, "uuid": "8c11cafa-b13d-4a53-9a9a-a211527253f8", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756905130, "uuid": "0db11caf-e309-4838-a52f-7ce0e989c2c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756905130, "uuid": "16a235cf-ca1d-44fa-94fa-2d5d93adb1e6", "value": "SALE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f1e140-88bc-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1756900237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900237, "uuid": "71b42f0a-7900-44a5-a165-0d46dcfc342d", "comment": "Malware payload (MassLogger)", "value": "c2737d06e868c2c9c4217405087fa29d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900237, "uuid": "86b9ca52-1436-4981-9c4b-1c6e4ad03394", "comment": "Malware payload (MassLogger)", "value": "0973bc15da79ab1527648f46d39016824140c56a2b4204eac047bdeb10bb7960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900237, "uuid": "bbc33796-56f2-4393-be44-b9619d230386", "comment": "Malware payload (MassLogger)", "value": "0ff743029c560626c371a4e41f7e9aca85966e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900237, "uuid": "5f0c0c6a-ff0f-4c6c-8354-c4fe361b8d1e", "comment": "Malware payload (MassLogger)", "value": "f673b723d586f757d7f1e81f54953579cfbbcc5d2d0d695da39098cae9ff7c6e0030052be04dcfb08de95b79ddbd2760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900237, "uuid": "94fb642d-e5bb-478c-93e8-7c970cf96e52", "value": "T124F4F1482256D60FE3B677B8D961D3346EAC1E8A6401D243DFE9BCE7FB3B2101C91652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900237, "uuid": "c710f436-5fde-4734-9d32-d2d81c85ff8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900237, "uuid": "6a4c286a-5ddd-4225-bf81-4cf716d885a7", "value": "12288:D0OWZV7bqq02oUsl6UHki41/ewNrnT/kHQOXFPWg+UIuiTZRkYOHG9:UbEdlLHIfT/cugrtaRpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756900237, "uuid": "ad5653a8-16be-4e2d-a830-ceb89d73526f", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756900237, "uuid": "e33279b8-3ec6-45ac-ae11-efb4fbc3dd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900237, "uuid": "7e88e13c-f574-42cc-b839-d29e9144a5ab", "value": "SecuriteInfo.com.Trojan.PackedNET.3393.8274.31224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02851e69-888f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880825, "uuid": "85442d21-5d30-4b01-a426-f59773e4ebc8", "comment": "Malware payload", "value": "9e6ba3bb2d9009ddf18290f2dbb750ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880825, "uuid": "018defbf-6426-4957-9fff-6626c28010af", "comment": "Malware payload", "value": "09cf66e4d2d730eba1dfdc37c074fc193aa81ff6f98fbd036b062492caa8561c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880825, "uuid": "fe46d90c-2b6c-4fcc-b812-9062ef7fbbda", "comment": "Malware payload", "value": "7f1d792fe712f9e1851463c2de88986601c07b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880825, "uuid": "2b5839ff-7467-4bcd-aa1c-4d8ceeea4862", "comment": "Malware payload", "value": "03fcaf546797076d5dc9a76e352755d3e0dedf3dd513a02bf9ab986ed39187f7cdaea013891529f47749ace240f6246e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880825, "uuid": "b312e453-4f2f-4ee1-ae1c-e9b0715ab3bb", "value": "T1D9D3B56837E5205EE37399394FD5AC7DDB22B26B0207B75B7063124A89099C9CF613F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880825, "uuid": "fe981dfd-9046-4a12-89e4-70861e6bb9c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880825, "uuid": "f9d89334-593a-4c18-ac1f-b932334762b6", "value": "1536:zSXcsIq3FbzYQ8LQA09u8rbYHiaiM+8v3gblTuYZYbUmG1KzPzCcTwCR2l9V:z4J5du09usb2qCgZTuYvmZzPmAwCR2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880825, "uuid": "91e8a2eb-c269-4208-9e88-e42c325fa789", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880825, "uuid": "257fb473-ec32-4fc9-a2a0-a5ee3212be1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880825, "uuid": "d80a544d-2da9-49b7-a65b-ad83f9458297", "value": "9e6ba3bb2d9009ddf18290f2dbb750ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2e02bd-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866772, "uuid": "21c2d8ca-7ed0-478b-bf35-2033cfd0b445", "comment": "Malware payload (Mirai)", "value": "2e00082d164c6983245696e12d0f0eea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866772, "uuid": "045606e7-7f1b-4e3d-ab0f-28198a1cdc5f", "comment": "Malware payload (Mirai)", "value": "0a2cf7a08b2049361a110db036ec9aee38c086c3c9880f22ea36a416bb9a30b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866772, "uuid": "bbf5c098-3556-45e2-ba8e-1e81e51c55da", "comment": "Malware payload (Mirai)", "value": "0a753b5be0fe7d76b7c275a70af2dccf0dd08e3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866772, "uuid": "df325a32-8d96-471d-9941-2f5c51d9d676", "comment": "Malware payload (Mirai)", "value": "f9d922c81fcea37b3a1d8b07b85a894c4f5297a265507aec4581b17167beb9e02e9c2ab874c3d165e1f6d845c91230aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866772, "uuid": "83efd02d-95bc-4336-a8f9-f7feb23ce911", "value": "T1D1A2D025D345AEF4DFEF9D905682C2C276E586C7278AC8E340FEBF01650A046B788D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866772, "uuid": "5660aa64-1300-4f0c-8caa-12d307cd2d87", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5gGM4uVcqgw05VxJh:mRxsSVsMD6xiJJE5zRWNKV4uVcqgw09n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866772, "uuid": "76f3ce4e-b729-434e-9bf9-2a978a550338", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866772, "uuid": "df331d89-99ce-421d-9359-375da6c301b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866772, "uuid": "4970b83d-968d-4df3-8087-e0ac839e716e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7e8f60-88de-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756915146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915146, "uuid": "57b01871-136f-4a22-b749-84848ce02032", "comment": "Malware payload (Mirai)", "value": "c34a5a5b0f94e43076bca276457c8375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915146, "uuid": "83833562-dc79-4c3d-ace9-ed9bafd29012", "comment": "Malware payload (Mirai)", "value": "0ac2df2704e5127accd26d293c1a0cd85a7c7a47028c60a48bdc352b46fdc338", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915146, "uuid": "a861d251-e0f1-4726-ba81-a63b8b0c6781", "comment": "Malware payload (Mirai)", "value": "285ae8df11e4a5fdeae73baabb191805aecb5b97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915146, "uuid": "6313a3eb-0c2d-4085-9259-ef6e36d86104", "comment": "Malware payload (Mirai)", "value": "9fe1138e8877820259fde4a86f510a1852cf9ca914e81922aef0351c42e35711c144deb1bfb13e2deeec5b2a3d98e58a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915146, "uuid": "38597ade-ba0c-41b3-ba8f-0059d8006432", "value": "T1AED2D09050875C20E3F00C71D8DDC1C6B6D617B5D9EE7297A5A113A4A8C35A21DEA2C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915146, "uuid": "ebd6e26e-a960-4a01-9a6e-7fde50eaf991", "value": "768:rMxj/HHepjxb21vcpqxHUfWNCQJ5bemgoFi4Js3UozbC:oxLyjxa1vcpqxHicvooEDz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756915146, "uuid": "011fa96b-93df-48e4-ba83-7a525e6c8fa1", "value": 30912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756915146, "uuid": "cede634d-e518-4ded-b331-e987d695a678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915146, "uuid": "76bbfe3d-9122-49d0-9d70-73d0e98bf408", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fa1924-8870-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756867728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867728, "uuid": "34ebe2a8-692b-4dc2-9e96-5f47ba7e0605", "comment": "Malware payload (Mirai)", "value": "338773b38fbd27fc3c4ea8f19d1c3cfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867728, "uuid": "93835572-7be7-4ae5-984d-90ccf926ce9b", "comment": "Malware payload (Mirai)", "value": "0b08003980be345eaf6c0c0ddd594e7052dd1986573d259d093a964462503d16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867728, "uuid": "fc6c1479-cb52-4c64-8a21-a6e3d68025ee", "comment": "Malware payload (Mirai)", "value": "02bb47c80ae5a607274234763c21e39759e0bb05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867728, "uuid": "99ca3a7c-d479-4310-99f8-c354c43d2c6c", "comment": "Malware payload (Mirai)", "value": "a6f392b38ffdc94690a30348a4c47863d89fce550e9c315b53e10d88cfb2c00eeeca21c611ed3697325d644442996a03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867728, "uuid": "2b0ee200-e19a-4baf-b252-241229549a8e", "value": "T144731B95F890CA32C6D156B6FB5E428C73130778D3D93202DD249F3967EBA5A4F36902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867728, "uuid": "d4e70bdd-ff17-4c58-a917-9622eda6447d", "value": "1536:YjOVA4jwL6UwBA7FN4ASpxQnY99F/3OM2M4+9LxeEsN4q6HNgpsTOW9tGIr:Yj+A4jwL6UwBA7sASHQiUM2M4wbsMXdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756867728, "uuid": "3b3e6ce1-d491-4581-9b9e-b2126c1bba75", "value": 75020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756867728, "uuid": "e1a8787d-7a6f-429b-96c0-731c7cac9568", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867728, "uuid": "3c074732-21da-4403-acb0-09f6c87bb353", "value": "kitty.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddbcfca-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756891769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891769, "uuid": "969d04b1-4332-4530-bfd5-fc83aacafe58", "comment": "Malware payload (RemcosRAT)", "value": "e004fcbeac1805733b78fb6ed45639d8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891769, "uuid": "d5e08689-65eb-4967-abe7-3b7dccf4fe72", "comment": "Malware payload (RemcosRAT)", "value": "0b6847dfae6c2262cc0225c533169736c4875463adeef4adcdeb09ba0a5ab54a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891769, "uuid": "6e40b35e-21f1-4f3c-8b8b-2993a496d464", "comment": "Malware payload (RemcosRAT)", "value": "6e346fbc273050099816f833caf6a2852d897e7f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891769, "uuid": "c5e7c967-8332-4f10-ae21-b8601a01d7f1", "comment": "Malware payload (RemcosRAT)", "value": "8acb77445374d5d108f85ae01d0e1b6171980fd4ba04df9238ec1bb07678d67996b5101ec7a7c1f99d305e70587ae8f4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891769, "uuid": "d33326d6-9a94-4563-82a4-c5bc5fb4703a", "value": "T11A8512967A44C467F3B00531D8FAEB3A0775AC5EECC852036BE137887BB2F6DA925504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891769, "uuid": "c19746cc-1073-41c6-a90a-5225448e0769", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891769, "uuid": "eca71bf1-b3ba-4017-9786-139bd6d0e2be", "value": "24576:b3PLTk4Iv3WaH5w+2dyN6+S7RhD9ai4ulKnnrg5q9jzoH5:XTk0aZZl6+SlhDTLlKnnrgC345", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891769, "uuid": "1156ca2e-b54e-45f2-8380-3a4e8518381e", "value": 1710122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891769, "uuid": "48fe7a08-d6fc-46ba-87e2-88d5aa9b6c0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891769, "uuid": "bec50db4-db85-44ff-83e3-f398cbf3306b", "value": "SHIPMENT DOCUMENT-MAERSK-SN-05993830019.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a92eb21-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913292, "uuid": "f1081704-722a-4591-90b9-a38374e49b0b", "comment": "Malware payload (Mirai)", "value": "90e23aa9808cfae846278df75ec6744c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913292, "uuid": "6955466e-2dca-468a-9bb4-973d734c28b3", "comment": "Malware payload (Mirai)", "value": "0e57457be2a76226a70704ce00fab0775150e5b30cb9ce1e37f6f0ee4b1a3436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913292, "uuid": "76e439b9-c49d-4611-8008-65e2aba01d8b", "comment": "Malware payload (Mirai)", "value": "c433d00ac8faf48f88ef74399acfca50d4dc37f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913292, "uuid": "2ed345f8-a979-47c3-a561-0f6928d851d8", "comment": "Malware payload (Mirai)", "value": "22c5c51bf5651126dda4c6b924241b466876547ae5ba60785bbef9d8c6efad2a0a96fd803f1741597d7881f77863bf21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913292, "uuid": "df46bc62-6153-429e-baf9-a3eadf5368ed", "value": "T16E336B36E029DED0C5960234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913292, "uuid": "9db3663a-8147-49d4-95a8-47e684d99c69", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+ydZCZQoVjfjmCozw:Oa4U7G7SvT6ftBTydZKVHmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913292, "uuid": "2394fb44-fc42-4bf8-9d27-79078c83ea2e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913292, "uuid": "dc24fae2-169a-49a0-b2ce-9fd4ac15aa54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913292, "uuid": "b7232096-e42e-45e5-8868-312800315f83", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677abd12-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929957, "uuid": "a42df67a-745c-4830-9121-ec1fd8f7c8af", "comment": "Malware payload (Mirai)", "value": "a8c5a9a3834cda4c28b6b3a44923b11f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929957, "uuid": "ea1d01c7-35fa-4ec5-a27f-3766d204f87c", "comment": "Malware payload (Mirai)", "value": "0e6e69c562067d0dc424bf3aad11d009131f25a093ec97ee7b071c6ff47406f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929957, "uuid": "d30276c9-028f-4922-9faa-b89aa1c703f2", "comment": "Malware payload (Mirai)", "value": "237e92d180b5c0829b085d0cf9bbe0b7db71e1e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929957, "uuid": "da4a51f8-dd7d-4260-b2bd-4729d1b6b541", "comment": "Malware payload (Mirai)", "value": "0c560a9da17f7f22cdedec9af9c7957d72df07c2c19a7ca749f00ba1b10ad0609ad1f1468f70e565a944a5fa75de115d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929957, "uuid": "6c688930-2111-487e-b8e1-b89d80c91667", "value": "T1F4936CC4E383C4F6ED5A01B29437F3365332E83A5019EB96D369DD36DC92950EA1A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929957, "uuid": "0185679c-b3e0-4ca4-891d-7bb160c7e6d4", "value": "1536:DPCfZDf59H+lH6J/TWsjsFjpTx2H6FkBhSXXhl:DPwZL5NKMTpcdTxo6eoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929957, "uuid": "b3d49ffb-6d23-4f86-a397-2ef24d39aa58", "value": 96648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929957, "uuid": "40fb4818-57de-4294-b980-bfbc0b3635d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929957, "uuid": "feaa129f-c139-49b1-9209-c3733678e50a", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dba9714-88ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756906372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756906372, "uuid": "4aa65102-bd07-49f8-b031-64f7d391eac0", "comment": "Malware payload (Mirai)", "value": "49b6553ee52abf08809dd9ed952a81b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756906372, "uuid": "63b71e9a-1a2f-4c7a-a9d0-4dd8a3f99a35", "comment": "Malware payload (Mirai)", "value": "10042c1b8692a8bf567a8be9a20f52b333aaeb79f5a60fb8ae9dc9a1a32bf323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756906372, "uuid": "bc82f8c0-d5a8-4fef-9de8-bb546835bd0c", "comment": "Malware payload (Mirai)", "value": "c2167d8f0a771a182063c21eb999175d2b0d48d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756906372, "uuid": "4314ddcc-d5b6-4060-a7c8-b6797e7df525", "comment": "Malware payload (Mirai)", "value": "706f3d906e5a8429358ca302f64924d839418e3a0a0aa5d70fb3587cdc536f947a593d002362e1e1a111d05c5dd88de2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756906372, "uuid": "e7fb3610-b7ef-41e2-9ce6-ca721bf618be", "value": "T18824B60AAF510FFBD8AFDD3706E90B4625CC650722A83B3A3578D924F54A94F49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756906372, "uuid": "ae133d0a-1da8-4b01-8b22-65288e351900", "value": "3072:tTwhuMZenmDFj31/Af8ugfeub9xCno+pLjND:tMKmDp1/E8ugNbPSo+hjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756906372, "uuid": "6f07c2a7-f253-47d0-b4fb-6142dfbb44bb", "value": 211960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756906372, "uuid": "932ffe7f-c041-4b16-850f-2f8ed7db067e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756906372, "uuid": "a9c073fa-8a94-4076-930d-9d612596f5b2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912aeab4-88d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756911988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911988, "uuid": "672c8e4f-66b2-4636-b607-2c6bd3b94972", "comment": "Malware payload", "value": "840e59bb2c10dbba04d4ce2593374cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911988, "uuid": "ed61008d-fae9-4d0a-b1bf-f44962810580", "comment": "Malware payload", "value": "11ba38f4207e87f80af96783d63233551f8e11f8cf1f66be913b77c81ca2f945", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911988, "uuid": "32b495ca-bf05-4fe3-8b96-b15cf51f2a5a", "comment": "Malware payload", "value": "15d6d01877e1ac32b923586d1a2524b0d2bb30fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911988, "uuid": "06635a15-a01a-40ef-9e26-5b6ccdcb5405", "comment": "Malware payload", "value": "51266a50d115a3be7fc71a9b3c8c8df367b4f1c00b7425d5ddfe3a706b071e98b68a18a1f742a594d020b0c4f6d745c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911988, "uuid": "b7071450-a21f-4bbd-8b95-9479933a7f3c", "value": "T1E2142B03D9A444FBC0CA8B760FDF95268773F47A1736620B6398FE951F09A98DE4E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911988, "uuid": "d1db3466-8dc8-420e-8270-0b141150c21b", "value": "3072:OOI8mO4yMPFySjKVzLIcmRUl9MX3xnoPIHZ9VBrq+BKgFubAPa1vxmcAKHNeyDH+:V9oRjXNoeSxmcAKHNeyDH0T5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756911988, "uuid": "69f06055-b093-4388-ac7b-2db9bd8597a7", "value": 205972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756911988, "uuid": "e9a8ecd7-5c83-45a5-9632-2d0a096af078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911988, "uuid": "9fc96e37-72b2-4cec-ab25-7ecdcce816cc", "value": "test.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ee424c-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756891939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891939, "uuid": "cdbd1b43-4449-4247-b0c5-2500b3de3a10", "comment": "Malware payload (RemcosRAT)", "value": "afeccdeca978d54131bcaf10f7bd567d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891939, "uuid": "ac76a56f-0139-41d7-87f3-83360d54d912", "comment": "Malware payload (RemcosRAT)", "value": "11edfa83b2ca5bc3601a73f30bbbddee9b18c91640d6a809704ba86c12bd1517", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891939, "uuid": "88e28fdc-b097-42af-a266-69ac997cb6f2", "comment": "Malware payload (RemcosRAT)", "value": "e62347445fd01fb5acace214707606804f81707d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891939, "uuid": "d6a58974-e9d1-4f33-9268-7d9889851ce1", "comment": "Malware payload (RemcosRAT)", "value": "a49aa9bbc4c1e89d8486f5b20af56da953388c4655be1abc8dae4dde924dfe9f1553f67fd4687f6b137a5b5b7027a66e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891939, "uuid": "b160cbcd-cb3d-47ae-93bb-330c60456c9d", "value": "T1B78394305D92AB2D06836279E5790AD264E64486813B60FE776A331D603139CFFB73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891939, "uuid": "2b6b92be-4779-48c4-bd32-12a55381b61c", "value": "768:SqgXLakAW7yz91vXeLpyGNCnbR3oOdS231+NCgqu7WAjTim7V:Svak9uzuLNCn94OJVb+TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891939, "uuid": "68321427-5e83-4854-a0c8-7b3f65120b9e", "value": 84491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891939, "uuid": "342570f3-4156-42bc-a01b-cd63ee003430", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891939, "uuid": "f63d36f6-0cfe-4235-b323-49f7fe451a73", "value": "Outstanding_Duties_Invoice..pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34c4aa8-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894006, "uuid": "8e8ddab0-0626-4ece-9984-eabdd7d23ff5", "comment": "Malware payload (Mirai)", "value": "eaf954582b69a38c3f58bc8368d16f2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894006, "uuid": "8c00807e-84cc-49fe-ac88-05e36647a81d", "comment": "Malware payload (Mirai)", "value": "12486e4b57bd5ee074988b64d0716aa9c631aeb5805d8fc7664063d5a98dfaac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894006, "uuid": "0ba28e9e-15fd-4f32-9f3b-d52cb3447886", "comment": "Malware payload (Mirai)", "value": "5942f03b248e38912c14e62b9929f1e2614e5a19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894006, "uuid": "5921dcf4-ce04-40ed-9807-247d89cd7f5f", "comment": "Malware payload (Mirai)", "value": "fa8ac741addd24a9457fa4bbd4cf5647d9ab42f07a095c9563d06bd756ed48b3d60763ad622e2cc4bd1396cf3a8214ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894006, "uuid": "d4492788-922d-44a5-8120-dc6f95259ee3", "value": "T14FB2D0A48B95A706C2B0B435A27C8F92593B15E4C6F639371B2092BC964156633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894006, "uuid": "3cfb98e5-2bb3-4f99-a35b-5c085e8cd182", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BWWNMhymdGUop5hu7u:4GaKQFH0rs3zWoDDRsjt7LB9U+BpNMsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894006, "uuid": "337447d1-06f2-436b-ae44-0978e7d61327", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894006, "uuid": "8590a77f-b62d-4a8d-9ed6-e6d37fa14b81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894006, "uuid": "41a80038-ec49-46c4-aa0c-64d955d64a6c", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42e4c9d-88a1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756888854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888854, "uuid": "4f337507-e0fe-4fe8-94ab-aa18740da4b8", "comment": "Malware payload", "value": "1397b709e5cd46d70465a8d4481f40e3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888854, "uuid": "b8ecfe06-4f30-49e6-8122-eed5ef5b0dd9", "comment": "Malware payload", "value": "129bcdd7adea13e799a8c3347c2d519b2ea7d3a82b858b79ecef8c0d10b549bf", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888854, "uuid": "c2b04a25-e6ef-41fc-9c1d-0d4d09e8f766", "comment": "Malware payload", "value": "c1ebd476b076b6fbb9d96ad239b06dfbc74bff06", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888854, "uuid": "143858d9-861e-4a45-a3ed-962a1089c65e", "comment": "Malware payload", "value": "a5e9085912f9c546aeedf04775b99167e9b036a06598f63170d511fa57e3ee5db95db191d1f4f4248595de024ebf1897", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888854, "uuid": "e337f444-28b0-4aae-95bd-91826b417d25", "value": "T150E6331DF2979A22FB5E55300C49FB161725DDC38968FB2B352213CAA8329527F60BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888854, "uuid": "27e863e5-1713-40af-842c-ad3b0417a33a", "value": "393216:PnW1OgVHvkIeHS+A+gPSD2HDzPZJcin1JlMP5PLz:PnW1HvkIZ+A/SiHDrFMP5Dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756888854, "uuid": "a0a7864a-5f47-4fae-8ea2-3fac058865cb", "value": 14049778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756888854, "uuid": "337a1113-2c45-4eff-9644-8520b1130e97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888854, "uuid": "33cb252d-a771-4fb9-a0aa-6a814c66a2bb", "value": "IC.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12782e0-88be-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756901304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901304, "uuid": "f433c799-d5a2-4104-bd02-ba15d6c7380a", "comment": "Malware payload (RemcosRAT)", "value": "27402f519262219babb9296a7ef73adf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901304, "uuid": "80c4507a-cb0c-4113-9331-1418c74b854e", "comment": "Malware payload (RemcosRAT)", "value": "13bf4765b4dd68eac1ba87a7c5d567a3baf7e3346f7dc6adcc843ba7da04f5c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901304, "uuid": "119ae209-5624-4947-bb2e-b2cad6b735fe", "comment": "Malware payload (RemcosRAT)", "value": "5e1f074e7f23d72a6f274a1a37c5e588a5ac024e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901304, "uuid": "0ee37878-c613-4f48-87ae-0b098ff1abde", "comment": "Malware payload (RemcosRAT)", "value": "f1648e761f331b863280e6dd333f37335c64dedf552fa38fbe1cc253bad1fc361db32509f78e84d519141b8455bd3c39", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901304, "uuid": "6c74dd92-53ad-45a3-b956-f774935b0e84", "value": "T1D2230FE4A17DC066666C178EE126C4880BBBA351FC7879C279AD921FBDCC5385DC63B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901304, "uuid": "591276c7-855e-4d77-b8cd-ee184bf4dc6d", "value": "768:IT/Z+fbAvSlcn6ue2SlZ/sRoJjmalBlemBDbJwabouWU/ByahwaZxBhbxSMA78RD:IT/Z+fbAvSlcn6ue2SlZ/sRoJjmalBlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901304, "uuid": "6aae422b-6cd7-454a-ada7-72691a7f9ecb", "value": 47838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901304, "uuid": "14faeabd-329f-4608-a6b1-79945d174570", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901304, "uuid": "cabb1e8a-2935-426b-9f16-0030d504a7ae", "value": "5108643690.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc809915-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756872117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872117, "uuid": "b6fb7763-5d22-41bb-ae2b-2ea8e024c53a", "comment": "Malware payload (LummaStealer)", "value": "25dfe566f0f1a65a104b3f50e10361b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872117, "uuid": "f6d6e335-e279-463c-abe0-e908c8968221", "comment": "Malware payload (LummaStealer)", "value": "13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872117, "uuid": "fe5a1622-8d04-4f39-97cb-70048ca13e8f", "comment": "Malware payload (LummaStealer)", "value": "58772b707e024b7a0cd31f6e5d5f3ab3815ef02a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872117, "uuid": "140b618e-cb6b-422a-90c7-014410a4e55c", "comment": "Malware payload (LummaStealer)", "value": "b7101baa047ab05b2b5f9c2c577da22d6b37239d99f5080315862349977f47b873d072f25900a527eb1d22991a2ab653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872117, "uuid": "1d486829-add8-4b70-ada9-ef1da2ee49cf", "value": "T1039501D97CB90AE0C61CC8B6847542E6E51D33797EB1B73F687FE089125ACB36721029", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872117, "uuid": "281a9f59-b0d0-4351-84ca-e7ea7cf01fcd", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872117, "uuid": "c95d3a6a-99db-437b-b288-e0648b8752bd", "value": "49152:GMT+xuzugOGS4BFmN0/51SOLMdcVJgmQLIAqi9M9q:pTwGD8q6S55fi9Mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872117, "uuid": "6aff587d-3f49-4fa3-bd05-8b03b207b10b", "value": 2027520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872117, "uuid": "30b5f241-700c-404c-ba87-7c7f2ef466e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872117, "uuid": "dea03d46-2221-4dc3-95aa-8c75346825c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712fc961-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866837, "uuid": "1187f406-38b9-4f8f-a84f-6e9e8411cad2", "comment": "Malware payload (Mirai)", "value": "fec03278561116a5ca41693a821ca216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866837, "uuid": "ae261e82-9524-42d1-ac89-9bfd9c0dc00e", "comment": "Malware payload (Mirai)", "value": "14015acadd20a43c538bb8dee7aaee049ab278c77e3e35a957a2a9b9db0842b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866837, "uuid": "d2f149f2-3264-4800-afbb-b0f92428b8f3", "comment": "Malware payload (Mirai)", "value": "614326e5785bb526beb197b5d97698b24880cc8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866837, "uuid": "f984af88-681c-414d-a02b-ab57246cfa4d", "comment": "Malware payload (Mirai)", "value": "b987850ecb5691614744fd6e50673fbc49d3d0c106b32f294d03caa72ab60964a5c8638bf60d3a5dc62da5829fbfcc15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866837, "uuid": "6086bf9c-63d7-4832-b304-ec4044621dc2", "value": "T1F0630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866837, "uuid": "ae7f0cf0-5f98-436f-9dd9-57778540cd63", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866837, "uuid": "03819213-8ecf-4480-a9fd-01713959e52b", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866837, "uuid": "3de88519-8d97-4c55-a4d6-52d3209ac5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866837, "uuid": "dacf060d-492c-415b-9198-682e06490e23", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d91cd3e-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929967, "uuid": "b98356ff-fa10-4088-b89a-90265b29fa21", "comment": "Malware payload (Mirai)", "value": "c2fe983dc38a265a32119a2086a58c84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929967, "uuid": "face7f2c-df4c-4c6c-8fad-97930e361282", "comment": "Malware payload (Mirai)", "value": "142800604ea18c8ea2434890bd17882d25098fdc6ccc59bc584d20ca99978e5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929967, "uuid": "48208ab8-33c4-429e-a7f3-83dd53cfc7ce", "comment": "Malware payload (Mirai)", "value": "467391efc7a9fd6c813eb30ecd837c83bb34bbf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929967, "uuid": "d60460d9-ab11-4e7c-ace1-7747da6feff1", "comment": "Malware payload (Mirai)", "value": "fe04706e8c363e215df645f1faa03b36e46c0b894385f6c82ac223984203b5c5d9efc78244153555f636479aa142748f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929967, "uuid": "3472b83f-e0c5-4b4f-bff6-c80977ae80a0", "value": "T10E335A21A9791E17C0D0F87A62F78729B2F50B0F25A88A5E3D620F8EFF209D0555B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929967, "uuid": "1cf6ba98-9f35-48c7-821e-9ceec25855a5", "value": "768:pz79EuoMefq9ysZ9yyPTfro4z7cYRJC0z8uO+hdv+nF6Y:B9EuofSysZ3PTfro4zgYRgchK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929967, "uuid": "35701e75-b626-4436-b8d4-8c5a0a2a9d2a", "value": 54748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929967, "uuid": "5fb3488e-33f1-4382-9252-271442c2aef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929967, "uuid": "0688e14f-7e1b-474f-8087-f9801f8c54ec", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48612c0c-88df-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756915302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915302, "uuid": "54ca8a68-4b9f-4122-a97b-43aac775f5c5", "comment": "Malware payload (Mirai)", "value": "f65fcb3a52a02342d9cd0df8bddefc8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915302, "uuid": "59355312-7c87-4847-8bd2-f832b678a8af", "comment": "Malware payload (Mirai)", "value": "145da09a099e8ed5e51043e11da207f5d32ee091cd83303b1de14d844a4d90c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915302, "uuid": "8be2ff58-d497-4773-94c1-aa412ca68b92", "comment": "Malware payload (Mirai)", "value": "51a54dfa1af215b0c1cfb02daa1dfc7de4dfa3db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915302, "uuid": "570fa663-63cb-4468-aceb-cd797e752ff4", "comment": "Malware payload (Mirai)", "value": "6bdf86c0957e0c1b0ab3bcc58010b62fab0933205bf5c859c7d5b58514b23fe49885745716132bff0bacb87c48b500df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915302, "uuid": "7c0ebd0c-9cb5-4a1e-b73b-6322747d7490", "value": "T17963025F732D58A7E510A1BD10A4F3F11E36C753E193B80A94A2E0863C4F9B43A974CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915302, "uuid": "b7e2823d-0722-4d76-80ea-26939cb37dd7", "value": "1536:HdPsc2oPPibx8Bbh6XgQBWUgPqxdQrgQw+rip6VJuk:HppVdBbh6Xg8SuQrgQw76VQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756915302, "uuid": "0ac5824c-f296-44e5-a640-92677081e3eb", "value": 68048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756915302, "uuid": "966f2470-4bb4-4bfc-9a0b-1611e09bf398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915302, "uuid": "37746abc-d318-41e3-9395-8c64ff014698", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a28fcf0-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872865, "uuid": "0c3da5a5-795a-473f-9711-03697c3e7859", "comment": "Malware payload (Mirai)", "value": "c4943e1e1756821759ac8489076efbe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872865, "uuid": "c1b2264b-5d74-4c36-8902-f7f62ff08514", "comment": "Malware payload (Mirai)", "value": "14bedf11593e45ffa2ab2b4479ba0da26433f0dc00490f3cc8581bbb9613311e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872865, "uuid": "80919238-c4ad-4dd3-8877-5a9d6521b910", "comment": "Malware payload (Mirai)", "value": "13b449a3ff680c9a7ac530bcf83840b4affcf2a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872865, "uuid": "abb3bfd8-8e2f-493a-a0a6-a8104bdb1c68", "comment": "Malware payload (Mirai)", "value": "cf67edec93c6ef5455e0fe50f487a5165ef700e8bcc05853ffd3b06624ef2ad4e00ad1711fa16e555a7b9d121e6c6804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872865, "uuid": "a990d81a-3450-4c5d-9fb5-42d0ebbf493b", "value": "T1BC83E8097FA54FFBDCAFCC3385B94B0624DC951622A92B766934E418F25B14F2BC3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872865, "uuid": "a3ecfe42-8cdf-4362-b9c7-bd04cff37aba", "value": "1536:phi6J44ewFqyaDY8d793zwo9ydeGZcCQUUKfrnNm0sT:RYkqVF9WeG2ornN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872865, "uuid": "492961dd-bd1d-4623-a2bd-ae1ac4454c4f", "value": 85552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872865, "uuid": "8def8132-41f0-456d-aefe-282158253fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872865, "uuid": "b75f4377-60e7-4470-bbf3-e346e05a039d", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5193b0f5-88df-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756915317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915317, "uuid": "a7ea07af-3233-44ee-b5d4-21b5a970e199", "comment": "Malware payload (Mirai)", "value": "9cc8e10bd7ffaa79f3d1b7df387bfb04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915317, "uuid": "947056b6-30bb-4db3-b535-78220fd5e9d1", "comment": "Malware payload (Mirai)", "value": "14fa98efe9e80d3edb48b342702b7782177ca4a7c701e7db5c03c2c8ae4dda0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915317, "uuid": "5f81ad42-d454-4661-9b8c-d14ea7571690", "comment": "Malware payload (Mirai)", "value": "3f27583ee211dd103960ae74bc12d110ddf0aca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915317, "uuid": "f9234937-d5c4-4e03-be16-7590947b3f7c", "comment": "Malware payload (Mirai)", "value": "66d728ca30ae1ef60b76f17705727a67a36a2b6e86139bcdedf7a36b23e967a4b04c8d36f47db6ddba28ec31b9ff2548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915317, "uuid": "5bb42205-8e73-48e9-923e-1df3f2509c93", "value": "T197343B42EA414F13C0D717B9F69F5245333397A493EB7306AA249BB43BC679E4E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915317, "uuid": "2ccb59db-8113-42cb-8913-ef872c72d5d6", "value": "6144:INYyJrOtBxkNrgt2oAoPapEtV+4/vkZgn2c1SGs2M/Rludn:INYyJrOtBxkKfAoPaitV+4/vka3sv/21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756915317, "uuid": "7f4b03b4-ceac-4a66-8d48-f5f3380f5b7c", "value": 238449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756915317, "uuid": "c77baec8-b31c-4e74-8dd2-4cd9fbe93109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915317, "uuid": "eaca231a-33ef-4a81-884a-6c1a5c8596c4", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272754d6-88ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1756894201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894201, "uuid": "51e10118-8f2f-4dda-9093-16b85dadb156", "comment": "Malware payload (PhantomStealer)", "value": "6a3b139ff890568628f0a9f4e35f7771", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894201, "uuid": "eb77f310-7547-4946-b010-da998ba6bfee", "comment": "Malware payload (PhantomStealer)", "value": "1572ddaf43ba8c4dfd433656b4ba16e60f6950b31a4ed4c980320df526b9ce12", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894201, "uuid": "26a2aa33-14f0-4cab-b84d-f61475a8817b", "comment": "Malware payload (PhantomStealer)", "value": "28d600eebf8eed5166b5f17cac141799debd2691", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894201, "uuid": "4c5671b4-db1c-40f1-91be-122d8db9a203", "comment": "Malware payload (PhantomStealer)", "value": "d6402f91b16ee58901453ff7034af92bc7810e718e4573d442ebc16a95a0e481f5c7a78f71736258c4b940324d34b7e3", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894201, "uuid": "bb3b7789-c52e-42e8-94e0-58bebd811e18", "value": "T1AFE2F2A8C6A9B3DA0A2485D3CCCC35F8623AC64DB8664B291F7CD3F35ED4C475914746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894201, "uuid": "fa5e7001-3357-4ac3-a547-369ff86e4dd5", "value": "768:uv+54seqglW/eTqvQuaWl3dTPLVU3lU8KBJOg1aehxukDH/:uNK/eTqvQuvVaVe/tosYkDH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894201, "uuid": "8a6aa30c-ed44-46b4-9620-2c36f699a4c6", "value": 33250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894201, "uuid": "adba624e-ec3a-4080-abd2-2ee498b5e392", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894201, "uuid": "c4ecc8db-99e4-4fe5-b30b-979805518f41", "value": "DHL-SHIPPING DOCUMENTS-GLOBALIMAGING.Tar.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f908f60-88e1-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756916200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756916200, "uuid": "aaa1b5ac-aa50-4f6c-8a76-cacde35d0391", "comment": "Malware payload (GuLoader)", "value": "ca20e92955c3fe4de3cdd3577768e89f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756916200, "uuid": "cff4926b-480a-43ec-b726-c3e73675e776", "comment": "Malware payload (GuLoader)", "value": "18386a8b8abb8bafc43132c737af5d5e7d688aafe72d6cc37c76ce05634ed22c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756916200, "uuid": "1c7e3e25-4d28-4b4d-99de-dd3f4cf72c57", "comment": "Malware payload (GuLoader)", "value": "11c532aca1477c5cfbc73f2359f45c10f096b19b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756916200, "uuid": "b024d703-b57e-4368-bd38-54a4b1fd99e2", "comment": "Malware payload (GuLoader)", "value": "9b927f4263776075fbd4610bec75ae16d1917ecec321837f3207b52191d00ef921adf7fae20ec04736c819adc2887012", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756916200, "uuid": "610cce82-ea53-4785-9e07-1339861ac96f", "value": "T108F25E50EF025BB60E83BBA86C881371C8DD424609668495F9CFE31D5206FDCEBBC59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756916200, "uuid": "eb5ada0a-6383-4640-836f-d49d9c7d8727", "value": "768:tsXhzER2jfOLW5UWe2390M6wnwV330+4SYABXp/ZPHBBau7:tsXSWqW5brmMEBKjYpZhBaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756916200, "uuid": "5221c150-8164-4dde-8d2c-84d561ec7db2", "value": 35306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756916200, "uuid": "0ec729a5-ccd8-494f-bf90-c41758b43d67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756916200, "uuid": "0173efb4-fec6-4337-a560-a9c03b2311ed", "value": "2025-09-03-0803.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c475ccc5-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756923241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923241, "uuid": "02183c6d-a503-42da-80a4-04180ae176e5", "comment": "Malware payload (LummaStealer)", "value": "3d2443398364b85eda749ba7a9159a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923241, "uuid": "757d48ea-a9c1-4a6a-a6d2-fc95e01c8932", "comment": "Malware payload (LummaStealer)", "value": "1848c1c0245e45a92c29001f6babad791b37f00c5609f6ac8a4605a34a9ad7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923241, "uuid": "ef19de2e-d121-4c4b-b6a8-9528268ab459", "comment": "Malware payload (LummaStealer)", "value": "d36631be73979b177ee8dd56ce56f1204305115f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923241, "uuid": "a08a89d7-1fb1-425d-85d6-ae6b7f23eccb", "comment": "Malware payload (LummaStealer)", "value": "d57fd18f95a1a373ddce5c23f7e6925428b9e224695ffe114582398f6c27a1d0917c1929387879c215df74edfe7c3fe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923241, "uuid": "449d2497-f607-4147-a0aa-21c6cbeb7bc8", "value": "T1DD4523616FDCA092D89A1EB204B45A4662B5F764683EE3371D04386F7B275C0DE33B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923241, "uuid": "5fc01cb6-f3f9-4d37-9e75-4b763459893f", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923241, "uuid": "80b709c2-87e6-4d7f-8af3-b1db328c40b2", "value": "24576:crAyiUnkSYNdnXPrKofQPgch1bIsfC0jW5Bqsjzr4OwUz2rIy2o:wsj/2ofQzIsfC0jWD9XkOFzUP2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923241, "uuid": "897e6660-dd6c-4ccb-aca3-12cae8a00bf8", "value": 1181969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923241, "uuid": "5ce4cc4f-4999-4778-88db-1b559dcbfb3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923241, "uuid": "f75f3f07-c2ea-43c3-a52d-8b307ee53f6f", "value": "iceland.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca861d6-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913296, "uuid": "2041e684-cdb2-4984-9368-3852d51686bb", "comment": "Malware payload (Mirai)", "value": "d58532926577105e7682b7df7a838f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913296, "uuid": "68e11b2f-375a-47cb-85b2-6469171d5dd4", "comment": "Malware payload (Mirai)", "value": "1881bc058ce4be5b9fa0eb3751e28790bf6e1d6f76b1291841d2c24ed3b93afc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913296, "uuid": "cad09578-a8b4-4a5f-af0a-5a9c4ab4aeb0", "comment": "Malware payload (Mirai)", "value": "f620d6fe6b425e38da1c70d8b30828db249c3b0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913296, "uuid": "e50774fd-d5ac-4bc9-98aa-54f35c5cfe8a", "comment": "Malware payload (Mirai)", "value": "48300b1c269f84395c73108304c04a24f090358459c236badeaee32d4d42563b22a89dadf014466716f5598b50bd99f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913296, "uuid": "d718037b-d966-43b7-a4ad-bad04371b298", "value": "T14423F1616940AA10F3B50932EC2C9647A7C997DCF2B974E137D8496C5A835D20EF3CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913296, "uuid": "0052babb-4995-4425-bedf-e3860b567924", "value": "768:JW2myW5zrY3m+KDOtELVpuyUEQNIM4ZktwkVlXFbkdzxkba9q3UELMIk9r/e/lQM:A7d5zrY3mVqtSEyUE0IM4Fk7Fbkdzyz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913296, "uuid": "198b1dae-adf4-4d4e-a360-64138e53f5eb", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913296, "uuid": "7cc4e357-c5f2-4d6b-9a7e-74184952bd80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913296, "uuid": "93d760ea-5f7b-48d5-97fe-6fee6caf5d88", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c2161c-889d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756887090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756887090, "uuid": "2f44418e-4e48-4639-8627-6013c1b408b6", "comment": "Malware payload (Mirai)", "value": "8eceae5ec1c6517e8cbda7d88b61a1fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756887090, "uuid": "1fc7c015-9647-4e44-8e6c-02c841793f73", "comment": "Malware payload (Mirai)", "value": "19020238bf9dd745f56bda1a6b11987ebaa1a6104de1866256cd3559852d7884", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756887090, "uuid": "6e30605d-2293-45a8-924f-969d98445667", "comment": "Malware payload (Mirai)", "value": "e623e567dcddc881643c1bdf99ec0f53428b52bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756887090, "uuid": "2632996d-d800-4141-a061-862334c0ab22", "comment": "Malware payload (Mirai)", "value": "1f49a2062827abf7ac3346ecc9aba245a7b907134eb7fa00d973326e0e75005df0f00d933c42c935d77e4e2bf76e6b54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756887090, "uuid": "93b81e65-5103-46f6-b091-7a1e814b77bc", "value": "T1AA336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756887090, "uuid": "879d818f-1872-416e-bdcf-0972cf76a65f", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756887090, "uuid": "84693246-d8ac-45c5-bc51-9810df4f8ade", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756887090, "uuid": "f4274f96-103e-4869-b8a1-8129732d05d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756887090, "uuid": "8f7ae82c-58ac-469d-b273-c19b14ea6064", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dc9e08-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929959, "uuid": "af8a0561-3c09-42fc-a776-5e8a304cbc80", "comment": "Malware payload (Mirai)", "value": "7e02fc6de28fc1a84ee3890708f47cb1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929959, "uuid": "b318d109-d18f-4382-80a6-b0364b2c82c4", "comment": "Malware payload (Mirai)", "value": "1ab6a2d3df42f87a8a507bedc6af444ff2bb78e99e435355929bccdb0940d723", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929959, "uuid": "f61cee4a-b1cc-4e0f-ae5b-3139f08877e8", "comment": "Malware payload (Mirai)", "value": "b04a2ae8ce3113ca5e586fbbcca13e0447035404", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929959, "uuid": "91a63d4c-eaad-453e-ab42-a7f2dc0e04c4", "comment": "Malware payload (Mirai)", "value": "b3ad4f3bc1695115129f3157d1d49198ad395b94b154731675f15598a8e791551e10c3ceeb4a3e52abc651dec80cc2bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929959, "uuid": "f84c6bff-eba1-442c-ae05-72c955285ec1", "value": "T1EAE07254205236863E030E507A2BFBC131802C46E620063EE3B9AF234CBCF007B0E832", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929959, "uuid": "5b0b8655-4ea2-4189-9bd5-a642baefbebf", "value": "6:hdc4660OXOZYzBqlQXZRlzTjafaqUZtL57bNwb:XUUOZYzYlE/jaC3THGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929959, "uuid": "1d2888fa-4293-4dc6-9cb9-fdcfa9604440", "value": 332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929959, "uuid": "64c54e37-c4b2-49ab-a415-2a99e1881da3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929959, "uuid": "dad00e07-8b62-412a-bfa2-30149c563bb1", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed29e82b-888a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756879071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879071, "uuid": "a7b1a199-2e96-4bda-b3e5-fd8dc2ee6d0e", "comment": "Malware payload (RemcosRAT)", "value": "6cf33236c41dffd5dfc14e7b948676aa", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879071, "uuid": "b52b7750-bc10-4b81-ba92-fd54ca15d864", "comment": "Malware payload (RemcosRAT)", "value": "1b0285cc2a215633f7c08196afa0905a887404509751de204529c0b1ded2fdb6", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879071, "uuid": "2ee164f5-9f0e-4f27-bd16-0da5d8b5eb24", "comment": "Malware payload (RemcosRAT)", "value": "69b8a18511af829a53ec4746366222dbf9dfc562", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879071, "uuid": "d66c4e06-258b-44ca-aa78-afd9974e4af1", "comment": "Malware payload (RemcosRAT)", "value": "24a68dbdffb5b544e252e507a7a8333710bc5c4fb61732834dc49ea0bf31f09f0d1b852f413e60c5f3f4c956a9505058", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879071, "uuid": "10af0e97-67c8-4008-bc87-52e0f5e70930", "value": "T12FC5CF5D94B05D925024FE74AAC5F793CCEA07851A174B920FE5E2A67202C43FFBB362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879071, "uuid": "3e28c23c-f125-4fa1-bd2e-d12e99c14437", "value": "24576:jg5kQ609tOBGGFs9nGr4WCRuSIHkPZISzt9tnq:yLNGEZId0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756879071, "uuid": "09bdd859-ae85-4f38-a36e-b1a536c69b7e", "value": 2617404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756879071, "uuid": "150199fd-493c-4f98-8bc5-16a524ee3987", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879071, "uuid": "61240b13-b8de-45b1-9e6b-6c11c0284166", "value": "IH02025000000978_pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb31c40-88c3-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1756903526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756903526, "uuid": "fa669193-2850-4dd7-ad4e-67eb67b86602", "comment": "Malware payload (ValleyRAT)", "value": "6819efc13de8dc6ea652425e98eb606a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756903526, "uuid": "0799be77-49d6-4312-95f1-b70e51256088", "comment": "Malware payload (ValleyRAT)", "value": "1babe1d289fa4d264663d9a25b10f3183f43d314cae3562a60513e1680017896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756903526, "uuid": "e84194b2-d18f-4309-8615-4bab3d38f73d", "comment": "Malware payload (ValleyRAT)", "value": "cf654f6b1afc1774a62f8578badaceeadc7075dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756903526, "uuid": "f1f35042-e5f0-44c9-a460-f1b1f89f4e9d", "comment": "Malware payload (ValleyRAT)", "value": "2cdc72304c7108834628b1b2ad2d08ce96c7478c0cef82fbf6f582f56d48f6dfff1b778e346aad938490c281270e5354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756903526, "uuid": "ffda9d25-e703-40d5-887e-5ccccf358c0a", "value": "T1A1D3394F77AD35FAD1B2C17880815604EB2374754BB58BEF079449692F222C4ACBBBE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756903526, "uuid": "6476e51c-9ebc-4884-a984-0f61d12c6b74", "value": "9f3488a2b5c66296a76a1fadde7044c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756903526, "uuid": "b92fbdec-4cf3-4759-a7e1-fb368c74d8df", "value": "3072:nQAFmfhYCrgBKFbwe8opRh4zJ2tzUhmS4y:npmGCkBK78u4FH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756903526, "uuid": "26b2adee-6f30-4f2f-8cf8-f5e54d37e813", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756903526, "uuid": "9598a62d-30dd-4ed7-a269-5eb397e8e74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756903526, "uuid": "313383ae-9c1b-442a-9c3d-51ab6c2de119", "value": "1babe1d289fa4d264663d9a25b10f3183f43d314cae35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adefb892-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756891850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891850, "uuid": "57dac425-a4e0-4067-b8a5-4945fa22b9e2", "comment": "Malware payload (GuLoader)", "value": "ec057398712f4e7de1080b7aa4e681bb", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891850, "uuid": "e6f27e3f-22f2-4f2b-a382-51516c051778", "comment": "Malware payload (GuLoader)", "value": "1c03065a80c0715115669f1bad64e2486b464b294ea957f4d83c3e0b418722e9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891850, "uuid": "137bf9a9-f40f-474f-b353-d7e21cdbde8e", "comment": "Malware payload (GuLoader)", "value": "e153fd5093a9d0829f8347066eaebd39355de215", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891850, "uuid": "b8995f71-f9e7-48ac-b7b7-0954d92aa8bf", "comment": "Malware payload (GuLoader)", "value": "39ca7dcbc4809d1d2f2f164ffe9f16b9ff5e5438d448bd1ad16b9eced25d4777e4b6941b02e2195e89df766fee4dbe2e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891850, "uuid": "2259a11e-3802-453b-88a5-eedf35e175f9", "value": "T109F24C24C9820DB64B47775CECC99670CDE94215CB2280B0FADED70AA2065DCD7BA9DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891850, "uuid": "38bb48d7-bced-4c4c-a3ff-6d5ad4dba2b9", "value": "768:8wmF2MxNhCA1kHy4v1YTrdG028336QiVW3QsE1ntbF:8wmMMjkA1AB6PdGa336XkgNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891850, "uuid": "552ed303-f07e-4a11-aa02-6bc0b4ac1f4b", "value": 34757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891850, "uuid": "2b65787a-0eca-44a4-90b1-33a7232edfa0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891850, "uuid": "27904387-e247-4903-87ba-7a209dc733c0", "value": "ordine.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6993ea7c-88ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1756893024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893024, "uuid": "6cefc71f-2c12-4a35-b89e-4419107cfa94", "comment": "Malware payload (ValleyRAT)", "value": "15f37cc4d31d6e6330baa5196fd93754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893024, "uuid": "5ff543ef-699f-45c3-b77d-c01efdd24107", "comment": "Malware payload (ValleyRAT)", "value": "1cc62d774236839a8067b217ed9844b475d78eca9b27c5f6419ad1ffa35b9d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893024, "uuid": "30018eaf-9efc-4e30-88d4-875028f2385c", "comment": "Malware payload (ValleyRAT)", "value": "e7b0044ae00f3ca54e585938ff1aeb78f2c15f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893024, "uuid": "3cae7447-60e8-499e-87e6-8fd6bceafda2", "comment": "Malware payload (ValleyRAT)", "value": "a7e2e69e3d56279ed4c6a2b2013d02bc40a5d79fece3dfde06e5c99e4c4d05652668d89d3ed61f76c4a336f58f6d2e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893024, "uuid": "a80f2474-7f24-44c3-a811-f5f467312514", "value": "T11274AED9D16E84C6EC057EF9AC1847CB5B2543364BB40158267FAD880F6B4FAC01EDEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893024, "uuid": "c3d050eb-016c-4124-b20d-23c72877a759", "value": "83e3c2e38a442145eaa2522b14e0d343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893024, "uuid": "59ade51d-5bc1-4f4f-a8df-879ac266eb19", "value": "3072:mS3/rBdSi67uoGqaOvW90Gnd+T/zVg+RuB1W6beDFanj4VaS2/:mi/ld14vGqTto+NzRuXW6SDS4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756893024, "uuid": "8875df77-59cf-4931-93af-937ecb3ff8a4", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756893024, "uuid": "5cb1311c-21ce-4ab4-97fd-7e873e6cb9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893024, "uuid": "2ee51e7a-85ec-439b-a9b7-f8b528543c0b", "value": "zFsyx8x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd82a178-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880816, "uuid": "54bee318-b659-473e-9d79-ce6be223e3d7", "comment": "Malware payload", "value": "0ba668b4469806d1020f31ddabcab637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880816, "uuid": "81e928f0-c7a9-4f44-b39a-916c911fa7bd", "comment": "Malware payload", "value": "1cf44826dad6da6da4e5cbe92d2b4253b67a06437b1be8af7e4145db56df83e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880816, "uuid": "c346612a-db77-43e6-a191-51fa739c8df8", "comment": "Malware payload", "value": "80d15cee43c2c175e92db765a5af60c8d3ea4dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880816, "uuid": "572ab7c9-7ebe-4384-8cc0-953f0f32c4a7", "comment": "Malware payload", "value": "ae4772bd7ab02288ccb0690dbfc7154e9b9668c77f94e05b64b5b5f839907e6418d9e471d4a636649f5b06865b203c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880816, "uuid": "536961c5-a84a-4582-a7a7-200ff9cfff85", "value": "T18952534FAAD660E0C4B9D03D9292352EF8B170B553716BCFAA50991B1732BF8B53D380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880816, "uuid": "9a3173f6-386f-41e8-b214-d1da0d78ba1b", "value": "192:DxpehN/g8rTPP2BV9dfDwC1dlCV8/F72Qtqnod0FHeZts4ML9:jOnrTmnbwC1dlJIQWG0F+ZrY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880816, "uuid": "29575ed7-1544-430f-bf92-3eea8339b69d", "value": 13336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880816, "uuid": "0e1fa0a4-a7cb-485a-b8ba-b70924a2fa00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880816, "uuid": "19fa786d-356b-47a1-a818-427c159964f2", "value": "0ba668b4469806d1020f31ddabcab637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60bb2be-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876026, "uuid": "abf4061f-04bc-49e7-a265-ff47c78339d8", "comment": "Malware payload", "value": "44fe006cbdd2df5e20e6a299e895f8e7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876026, "uuid": "e69821bd-776d-49df-95f7-a3d587d025b0", "comment": "Malware payload", "value": "1d363cb0c3583ce95f8bb4fc93302b78690f32c37b93f27a9525a480567f0aa9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876026, "uuid": "51fac83a-f6db-4b1c-923a-ceec6935b46a", "comment": "Malware payload", "value": "3923c096b20592da328bd796374863ae517a0eed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876026, "uuid": "a7fd88c2-2a94-403a-a0f5-e5ee81d5558c", "comment": "Malware payload", "value": "391791bb051981c83e99292b04fc8f35e979c8ead1655bb5274bae5d1be2ce477a410449d491d82afdcb3e8601d45e69", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876026, "uuid": "e0539f21-3edd-4f5d-ae0b-2e4898a9f8c8", "value": "T1D7D2E605BB7A6DB0FF97F5A0A20D045479C890464F8B7808B45D3CFD962EEAC679902F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876026, "uuid": "19188e6a-c502-476e-89fc-25ffce042f16", "value": "768:G1zO9x5459ha/5HaM5G520zI3huSuBB2TJ7WTJtm9SPwfT31X13g5S47drMz+i:IO9x63ha/laMEA0zI3hTIB2TJ7WTJtmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876026, "uuid": "28fdeaf7-ebe4-4f80-b132-825ef9b7a39a", "value": 28874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876026, "uuid": "ccacd8c1-e60d-4862-831c-5a00863c1d1d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876026, "uuid": "f8b348a3-a203-49ee-a11f-b0ed5cc903a6", "value": "install_rocky.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebc7c41-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872685, "uuid": "0ed9b8e4-4a6b-4cab-bda5-e1f29c167c8b", "comment": "Malware payload (Mirai)", "value": "a5fc37f0ac7e87ca9c88c3fd2768f8eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872685, "uuid": "cb371cd2-bee5-4625-a452-3774aeac2b74", "comment": "Malware payload (Mirai)", "value": "1d5d43767d3f8b03ef1aa0461e12012b51cd599e3e1a6facea20ee8503aece16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872685, "uuid": "3474fa20-29a9-4d75-9e4e-4bbfba0def60", "comment": "Malware payload (Mirai)", "value": "9e747829c13db30cb7ad13f7b3ce2a6a6b3dd615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872685, "uuid": "115bb672-9282-45d1-9a01-8c78821cda8f", "comment": "Malware payload (Mirai)", "value": "66ed3a143571e358575ce8eb3a56b75db025f42f1fb69ac2b4d063875fddfb7599bef07817c6437896412aede557bf2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872685, "uuid": "a812209d-9a0c-4ec4-8a97-d24e2b2e94d9", "value": "T178834AC9D5C7D1FADD4616716933A332AA31EB345023EA83C798E634EC02B96E54D34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872685, "uuid": "6300630f-6fe6-4003-93e3-4073625502df", "value": "1536:miouaikOs3naI+wmKLGCNBV+l/fTHTr0Fcm0wesT1:mTuaiA3ndv5GCfVIXTH406", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872685, "uuid": "4fc094a0-511c-4bd3-9c4a-585123b42d9c", "value": 83324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872685, "uuid": "8b4ff037-f7b7-412d-b802-d8e1fd15a582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872685, "uuid": "011098c6-bb6e-43dc-9ba2-da4c8bcda3d1", "value": "dddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7985015f-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872864, "uuid": "2ad01cea-f171-44e1-a3c5-679553f75d2b", "comment": "Malware payload (Mirai)", "value": "383db957bee311694653de975b8d318e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872864, "uuid": "2ee3b920-d661-41e7-97f7-09462a1b82fb", "comment": "Malware payload (Mirai)", "value": "1df2bd280a04bf400027d681779dbe645cb7127db77f2f060f4b550c12db3acb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872864, "uuid": "87349713-e348-440f-ac73-35590997bddd", "comment": "Malware payload (Mirai)", "value": "9adefb46c9552bb191654d57ceee1523b116bef2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872864, "uuid": "f99801b7-efa3-4d3f-925d-ba4b42e6a0ee", "comment": "Malware payload (Mirai)", "value": "16a8a968eea94ea65f251e674e7f91eb7eb0cd3b913e0f377c33f00479b6497d0cb12a8c633dcb58ed15b460ca2ce0f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872864, "uuid": "0ab9274e-2379-47ff-b653-a217d475e604", "value": "T17F53F785F84BCAF6D40B48B19867B67F9770C6684120F25EDFC6AFA5DE23341831628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872864, "uuid": "b6fac043-ed12-4567-b966-9df7cd5af000", "value": "1536:hL44EIq0XlATxaysOJ8QYZiWDbqxGdgsTiR:hrEIqwATYm8QYZiWPzcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872864, "uuid": "95cff6aa-1ebc-4616-bf28-ee2f0c4bc521", "value": 62832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872864, "uuid": "ca062cce-889b-4f59-aca3-0f96f5ed798f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872864, "uuid": "c4152ce5-946a-44e1-9506-d16e85b42deb", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8975f682-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1756891789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891789, "uuid": "cee2e637-f366-4075-b2eb-4f12309e5166", "comment": "Malware payload (a310Logger)", "value": "eb618e164befcbd3392f77252b6caf42", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891789, "uuid": "4230a6f3-9afa-479e-92e8-f9dd5d2daa09", "comment": "Malware payload (a310Logger)", "value": "1f8238b656161f5e598be3a069926d03b1554bdcfd079d0fb11604a64255d368", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891789, "uuid": "1424cfd6-b12e-487d-8608-1d53a59e122a", "comment": "Malware payload (a310Logger)", "value": "26f8c1631e517adf4d6411dec9b815e90ffd99b2", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891789, "uuid": "1256e76c-ad0c-44cb-9259-22fec1664f98", "comment": "Malware payload (a310Logger)", "value": "1d019e84a7ccc2634929e1f6956ed5bbfe2ba79829327d45a419b63b7955025b51af77c71826f9c6b7581be7791582f2", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891789, "uuid": "c485a6f7-8301-48aa-8c6f-3e95a33e1cda", "value": "T12535BF0273C1C062FFAB96734F56F6115ABC79260123AA2F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891789, "uuid": "5082ca9c-004d-453e-8e69-50528bcd592b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891789, "uuid": "10e796d5-714d-4471-ad7e-34c9a53b03e1", "value": "24576:+5EmXFtKaL4/oFe5T9yyXYfP1ijXdaXTzqItmjXhmlpL:+PVt/LZeJbInQRaXTTtmjXhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891789, "uuid": "f493c82b-3909-4952-a138-afe4c2402c0a", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891789, "uuid": "4a282c40-7ae7-4f05-a5b7-fc708c366a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891789, "uuid": "e7e88877-a7f3-4a99-8b71-6a72e1e765ce", "value": "DHL GUIA 1Z4815906897663406 Confirmaci\u00f3n de env\u00edo 1Z481545456666340634674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d618619-887f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756874159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756874159, "uuid": "162160e4-1a10-478e-bff4-7cf34fbaedf7", "comment": "Malware payload", "value": "b56174aefd635d0a6167340dc22dfaf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756874159, "uuid": "14c76ff6-bafd-4332-af70-dc5aa6f24afe", "comment": "Malware payload", "value": "1fb1ab4e3fd05fb92c7bf995874116caaf8c6522043f96e7819ca46040e29d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756874159, "uuid": "8245ac9b-511f-49c1-887e-f9e729717d69", "comment": "Malware payload", "value": "3e6c4ae46e939cfa6d0febda6403717fbaf28c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756874159, "uuid": "9f7c0fa8-01e4-430e-9175-9a81e35e26a7", "comment": "Malware payload", "value": "95f18b2b853cb865779a963055c6b1667ff0e9fb6e75515ffaebf3a44254cdf4f919bae46e7de48e7af273de1dae31c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756874159, "uuid": "be10d517-ec37-43a3-a4a2-c0764c99fe67", "value": "T1EC45D0189C7590DAFCD340706F76A112E533BD3BCF242AEB51E497512A16EEC0E3A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756874159, "uuid": "be59ca7c-6181-4fda-8223-d3b916b21b37", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756874159, "uuid": "be961d15-b15e-48be-ad07-d70acd597b14", "value": "24576:qUYxEL+Rbj/0c9qx6rFdmJYPq79asQIOfdx:qUAE69t9qsF0EUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756874159, "uuid": "16943166-b29c-4002-92f3-a93119878eae", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756874159, "uuid": "1d620f5f-a6d8-48a0-82ca-d5238fbc75bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756874159, "uuid": "8be9f282-28e4-4ba0-b5ac-b455aa1f8228", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16c5ec9-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876018, "uuid": "0c133b83-f136-4fd9-90ac-ead4324a7566", "comment": "Malware payload", "value": "44e2ccef749ae6f7c9943e20253b1157", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876018, "uuid": "ae89ca62-d3c2-454d-bdd8-9f0665b3ae28", "comment": "Malware payload", "value": "20967c25fb7c96f231f2a0fbd578a0d7f85fa17583e1d667e28e40354e65b7f4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876018, "uuid": "f5d35c6d-4eb1-443a-b72e-d2b19d8ce97f", "comment": "Malware payload", "value": "c2b1f39fedc4a4b9b2171f6785df2394a5ddd26c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876018, "uuid": "74cc4be6-9c04-4fea-8d99-16fb4509cbf8", "comment": "Malware payload", "value": "c59d15ce4c0156f349a1ac38d74cbd0f154f0d7ada31f33a91cc88a8ce713c0a7973a8ebc36540753a4aba6239a891c3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876018, "uuid": "18a40821-9be3-498d-a2d1-cf49035fd76d", "value": "T1B3B1D5A1AF60ECBD1B819DA0EB5562D4F420A2C30E1F790434CEE09E1F214F1327EA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876018, "uuid": "591c55e8-8e57-4387-91a0-e8cc44360c8e", "value": "96:LfsdV7K8m8XQb8ztEeb4dbdd/6tZpwWzYn42j5Ye/ACgmR:Yd5zWbdd/kLwYYn42j5lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876018, "uuid": "9bfb81bf-b2f1-4b4a-9617-1beb6ce783e5", "value": 5334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876018, "uuid": "8940e53e-9136-461b-aaf1-a1d6787837e5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876018, "uuid": "a95f34b4-f481-4ebd-88e9-3056f26d4554", "value": "dnf_8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929a2094-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756891804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891804, "uuid": "08eb3db3-7d6f-40d2-81f6-e338ae074dee", "comment": "Malware payload (GuLoader)", "value": "29b8771e760ef484c3bbbcab0fb2d9fe", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891804, "uuid": "b38a29d7-02d8-4454-a566-5d177abb50e8", "comment": "Malware payload (GuLoader)", "value": "20be70d685e98d62af3abad23cf5413b83950b17b72b64e38667908e1a1c39df", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891804, "uuid": "6c047e31-13de-482c-bf95-b0ad656716dc", "comment": "Malware payload (GuLoader)", "value": "2c93ca0013b3932603465fcdcbff57895366398d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891804, "uuid": "8fbbfd54-ef2e-4a35-8330-cbb331d5fe5d", "comment": "Malware payload (GuLoader)", "value": "69ac997635beb19f16dfcdeb4059201c28a98d66dc893f95f096f3c38fe8174fa9cddec40a44e0f8c058d53bed528db2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891804, "uuid": "4a69b2d6-17f2-493a-a91f-f2d645b300ad", "value": "T1870802C3F70495F3CA7A4C37A1AA05231A62BD3D4445816732C8FB6E7AB31C69E36617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891804, "uuid": "e465f6a5-d090-4217-b28f-accd336318df", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891804, "uuid": "e5c62484-c3e7-47ca-9961-0526f21569f6", "value": "12288:kzgTw9KFFhJ8CZD/cLx7nA25hC4aaFkMjrKPv7In6eZpvhDwNvvjp:fT9FF38W0x7A25oNm8vs6efGJvjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891804, "uuid": "dd1bf2d8-afa0-4642-97aa-81f40ca13f23", "value": 80740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891804, "uuid": "a2132459-2223-43b9-9cf3-18cf06c52595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891804, "uuid": "db16225a-dcc1-45c2-bb38-ed8d5e6640b1", "value": "DHL_9876455478906795655866457965343789.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d866cef9-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756867010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867010, "uuid": "1f06668f-f664-4b2a-9971-ff6e1ddd78c0", "comment": "Malware payload (Mirai)", "value": "c9f2e7b2af3bd762c72f5a5a771a196e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867010, "uuid": "1a05eade-9658-4780-bfdc-40396cb69ecb", "comment": "Malware payload (Mirai)", "value": "20c7fe63ea801e2b60bd06e6568dfa1afb8f5a10950d06ce84269737d2e9e867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867010, "uuid": "0e0330f7-7428-4701-8b0b-bf4c8ec9e99d", "comment": "Malware payload (Mirai)", "value": "fecaf599b89088ab094c17a945ae44a0668293ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867010, "uuid": "efd0a28d-411d-4b86-86a9-8198ba575814", "comment": "Malware payload (Mirai)", "value": "9b97083c97a97e5f1cfe5f1a19c6042428e67da659ec5e5580f4541da91584be0595924d7eec3c8fdfd637e67d8f531d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867010, "uuid": "3d6a96aa-5ca3-4d37-b2cc-cd52b5f25dc8", "value": "T1FFF39E97B30B6050C8E50AF41BCB4FAD293721008E6B99E77D2E763A5A775CB28073D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867010, "uuid": "a2d54b5f-a53e-4b7a-82b7-5421f51bdb24", "value": "3072:J8DKO+0D/iPO/MoSFQAG7XFPGaabL09RCaqMkZg1CZQUBiehq:J8O30D/iPO/UkXFPlabLsYBRqCZQURhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756867010, "uuid": "f4f2b90c-9fcc-4811-bec2-a442ad36798a", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756867010, "uuid": "bc1450e1-c4de-44cc-8371-75281724cc32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867010, "uuid": "c6452a50-2a5d-451f-8175-5bb98353f5da", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8d4039-88ac-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756893569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893569, "uuid": "084d551c-99c4-4751-aa58-56c6f4a304d6", "comment": "Malware payload (LummaStealer)", "value": "48d2a1ba83291ade0d081245aabab5ae", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893569, "uuid": "1c0101f4-2d94-41b5-b96a-ba870c30cfa2", "comment": "Malware payload (LummaStealer)", "value": "20e4a7b977f3fe7c9c21f8fdaf1a676f66618e4a151c7d4d3b8481d48189fbbe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893569, "uuid": "6413bd64-f189-471c-ae83-eed8f660bd8f", "comment": "Malware payload (LummaStealer)", "value": "a2d5053edf3a4e30291cbda0986fd301ad89ef96", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893569, "uuid": "ac92d389-66ca-478b-bfa1-06c5eb5dc14d", "comment": "Malware payload (LummaStealer)", "value": "ce21f10d476527a1d6e0f2f59e456b328023b226e019e54db591c3cdc7451f507238f441ec6db29041ceba614474c1db", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893569, "uuid": "d8fd2a86-b123-4d39-86a8-ec8d8bf789c9", "value": "T10785332A4D135869CBDA0DB6802E1B053CADCED5CB74A61B266C959C479F9C3E0FE3C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893569, "uuid": "ef7a34dd-2f12-449c-b929-18443d8a4ce0", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893569, "uuid": "461a8a89-040b-4b7f-96bb-2cd841b6d760", "value": "49152:tt4BXP8c4DGVGMhiTvo19W8asWcQ1hSg:ttMfpP9hXmDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756893569, "uuid": "6e941879-d78a-42f6-a0e6-0415b3b300e0", "value": 1817600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756893569, "uuid": "3efcf534-a0bc-4933-ab8a-978a0d834846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893569, "uuid": "24f2f90c-98b6-49f9-83c3-da22c36b868b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cae644-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929987, "uuid": "516f2b09-8f73-4d1c-8d3b-6bb082855d40", "comment": "Malware payload (Mirai)", "value": "2db38dac9551b017b86289cda2a9fe69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929987, "uuid": "607d6af4-b399-40c3-887b-944251bef9f1", "comment": "Malware payload (Mirai)", "value": "22a24b7f5601619e044ed02e743816596d46ad1dc7ac6ce2fc3491bb97fba0d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929987, "uuid": "f8251a25-fc62-48db-be2d-011a1b7654b1", "comment": "Malware payload (Mirai)", "value": "39c0236f3d290ba6caff226c2000d03de0a5660c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929987, "uuid": "0e2e234d-0906-4cc3-9ea1-a671775510a5", "comment": "Malware payload (Mirai)", "value": "7fc9a1dd22c1377c258c127ba085d038a80342767d0bc04734f16d4cbbfaff12e93e3a2742cbcca5df9fc9b75f03c513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929987, "uuid": "4eabc3c0-94b1-4523-baa0-9c7de348b76c", "value": "T1BF84F156F20B2D83C9EBD435298AC2459795E89733F383063F42A5BB38296778F38745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929987, "uuid": "93108b88-77d5-4731-902f-10c61d4e1213", "value": "6144:2Lh8XkjKLb6jL5tGtugZN8/WVD6/eb1dVLDPf6cDnr78prZRuOM:2LLmbeLDcweV1x7L6cDn38prZRdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929987, "uuid": "e751c3ca-bb9b-48ee-a94f-5f2c61d95f2d", "value": 399344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929987, "uuid": "ac30c901-d3c0-42c5-8f16-492410bb2b3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929987, "uuid": "e60fe044-719e-4e21-97a4-3c30d6fc195f", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6b3b48-88b1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756895496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895496, "uuid": "694f9535-b8be-47a2-8c6d-a36399e9134e", "comment": "Malware payload", "value": "6e3e69a1a049608fa207342e019bad9d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895496, "uuid": "6909ae7d-3dfd-4685-8cc2-4c36e02e6025", "comment": "Malware payload", "value": "22b8c0a519b0897e4a201ff626dadc6d7b29264ed77c76835cae6ce3e615a6f6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895496, "uuid": "fe3c25fe-e965-41cf-a536-d02f050365e0", "comment": "Malware payload", "value": "054bc15a3308572cf3517d02159d6bbd990886d0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895496, "uuid": "667e5ef8-db35-4a92-9a9f-ef92efeeeac8", "comment": "Malware payload", "value": "07940d809e82e279d30cba0836556d9fbcba00afe13f768b56e6ae4dbec26f51a00d7c41f0098aa8cd1b8c4e963c6e1e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895496, "uuid": "575b7dd2-dfeb-41af-aa42-c124b78a0c18", "value": "T151E14B641A5A094CACC652881E80DD1BBF3D743BD7091764D87E7276180C66EF3B13EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895496, "uuid": "3c8bc598-26a5-4e14-81dd-f963c84b7c99", "value": "192:qK0FDCumt8VESgA3GdLOV9zjpXPL4Hf3Lxe2L:qK0jVVELdLOVh52F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756895496, "uuid": "e902453e-24b2-4cb9-855c-ce7eb8d4b1db", "value": 7088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756895496, "uuid": "45a9d855-d64c-4950-993b-046927903e2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895496, "uuid": "97fa58ca-fbca-4a0d-b10f-66411075700f", "value": "Vakuumpakkes.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3b8cba-88a1-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1756888626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888626, "uuid": "7f104cd7-44a7-45a9-b1f7-2a5ee7afd12d", "comment": "Malware payload (PhantomStealer)", "value": "43cf2de1c0182294c72a90cdd0d1f7a9", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888626, "uuid": "97e1d7fb-a7eb-427b-9641-5d0fdb73fb96", "comment": "Malware payload (PhantomStealer)", "value": "23189ed612ac144d409f9a3256c324fcc669283b9d16d61831dc48d430c8c20f", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888626, "uuid": "50f52c2d-50de-48c3-85f0-c66ea26338be", "comment": "Malware payload (PhantomStealer)", "value": "2ef085c7a764d3508f7cb0bed21a648289ae5d70", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888626, "uuid": "af67e21d-505e-478c-9213-1637a2cc48ef", "comment": "Malware payload (PhantomStealer)", "value": "01aad29836dd8a12b74c2cd57dadb87d6f4e51282bb65c892dc9a1cab5d6bac88149a40dc6c21859ae0de7977079439e", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888626, "uuid": "2b3ae597-1c09-4209-bd76-b5d122b33ddf", "value": "T1BAF2F1AC9F156261C8FB7CEA626244E420D1F65784628BE45D076E3D8B90EB8EC11F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888626, "uuid": "f84bc8b1-cbf8-4a91-958d-f5084969ff7d", "value": "768:2YsDx6FQDCAMB7OoykbM7fyn+YJlqvTt0oC0mEO:tsDx6FQDCAM7bM7f6Jut/xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756888626, "uuid": "e81b83af-5c5f-463c-936b-99d025c99263", "value": 34954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756888626, "uuid": "f99f7b36-406a-4fa1-8090-0cd1a22384a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888626, "uuid": "1e4fd29a-7818-4166-9180-559a385b01fa", "value": "RFQ-PROJECT SPECIFICATIONS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6f8a76-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756923281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923281, "uuid": "66a0d032-e689-4eef-996e-9662a576adcd", "comment": "Malware payload", "value": "bc7549342f3c9437a0de86f4b118a3a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923281, "uuid": "5a2fe743-77fc-4f41-be84-7285d8bc4eab", "comment": "Malware payload", "value": "23961e5dd1dd10906a4a34b885ce0b40b9ac543e5fe183a8546da74bf4cbd58c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923281, "uuid": "97c1909a-866c-4dbb-95ca-9e4e13cf8819", "comment": "Malware payload", "value": "debcf54def0532f7d4c65771be1b6de012c74882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923281, "uuid": "fa7fc6a9-0007-4609-b25f-005b63acaced", "comment": "Malware payload", "value": "ba02dbf4973622f9d8ae4fcf3249f7f99d26328134cd441e6c25d8730fe670841c165610140d87f99793b9d129ef5093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923281, "uuid": "11c199ad-be03-41bb-a15a-b47ff8e5af95", "value": "T1FAC633C92E924CD8DE9350B959C8155D91BA7C7DF7B4868316EC2AD0F8370C0BA67EC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923281, "uuid": "539feb59-5064-4302-967f-ad56b69008b3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923281, "uuid": "c31ab51e-129f-4917-a9cb-4cc7065dd715", "value": "196608:Dc0W8/9E66ufXMCHGLLc54i1wN+ZqPIcu9KYK39srRqZksfidb3PP+TMpIRpvx:DLW816IXMCHWUjR1cuIOeTEb/P+TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923281, "uuid": "3c9342a9-375f-4789-b1ef-d244ecadd6ae", "value": 12010193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923281, "uuid": "46e86aac-97fc-4f35-a16e-0cf85ddbc0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923281, "uuid": "700702ec-b27d-4c67-84ab-1956c44d35fb", "value": "D92glFN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc39048-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872681, "uuid": "0510997f-d81c-4260-bf36-ecc4f9cdd17c", "comment": "Malware payload (Mirai)", "value": "7da43f040a9f13d0ecf650e380376d20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872681, "uuid": "05486927-0e11-4e43-91a0-72c8c19c1545", "comment": "Malware payload (Mirai)", "value": "2483368c706088131cee56b9513640029851b44508c82fffce67739624b68c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872681, "uuid": "12c821de-296c-4bc0-8193-88db91547d75", "comment": "Malware payload (Mirai)", "value": "c48ed02dd844892db2b9d3c201185666fad43642", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872681, "uuid": "b1783afd-6253-4edf-baa6-4f8e08c887d9", "comment": "Malware payload (Mirai)", "value": "5d9915d4e8d035c35cf9e2585bf05cc9d08bcb980cece75e3bfb294928286206776568159b4fd0c60af8e7517d35aac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872681, "uuid": "a7efea2f-3452-40f9-82b2-b7e5854554ea", "value": "T1862132A6B2C44C94CF34DB385F600761BB86D9B9C54FE3CB4E04A1EC1D272881A58095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872681, "uuid": "8ff20878-ed69-4ee1-85ba-59a470301a2c", "value": "24:7QYdGtlH4rUpTXtWpG8MUaktmEyomsiC1FGVikC7m1qgpNfex7:7QYdIH4rUpTXtWpGl1Eyoms/1AVi772O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872681, "uuid": "6b76d386-340b-4ac3-833f-45268238571f", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872681, "uuid": "72c1ba49-5964-41a9-b4d7-d1e8085164bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872681, "uuid": "594661b7-f4f8-4aab-8545-613a07cbf734", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4175167a-887e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1756873629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873629, "uuid": "fe9c58fa-8321-4e7c-9c62-840516770c64", "comment": "Malware payload (RustyStealer)", "value": "20f658205b206c887bc7c67ba1d14074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873629, "uuid": "4632623e-e025-473a-90c3-d42a221e718d", "comment": "Malware payload (RustyStealer)", "value": "24ee0bdb2692d45c41c7f6b8cfd47e31546c8d04278e23463bf0a8629a99137f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873629, "uuid": "dbb2f70d-4244-4b6a-90cd-dc9f81c53db9", "comment": "Malware payload (RustyStealer)", "value": "341bfdf19025554658d02484711809b9fc35333f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873629, "uuid": "9bbb5521-3d10-4cf3-8afe-0b7508e2a1d1", "comment": "Malware payload (RustyStealer)", "value": "902bce65ea0508493911a1aff1850adce2f445eceb16d42c983aad265c52237d6784b487fac65cc024b59cb5b23ca71c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873629, "uuid": "a292ecc5-2177-4c4b-91d7-a91449841afe", "value": "T1F9335C063AE1C171D86603301AB9C693567FBC729F74C6A7BBC8068D5E716D06E393A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873629, "uuid": "40cef1b0-4807-497a-8d13-5053c8dc84df", "value": "e13e81e2770dde23350136d77ccd510f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873629, "uuid": "6726cbcd-8acb-4a48-adb4-f7044218d8bb", "value": "768:5eh4sakbs5SJ0RNMDLB+bY2IEpzneNKjWzjeBEGcFTD:o4sa2J0RN8LOl46aLFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756873629, "uuid": "8a3465df-8101-496e-8907-44aa98b26a4c", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756873629, "uuid": "958e8bfd-6703-494d-b459-065a05fa13ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873629, "uuid": "456b277b-0674-4a00-8327-493443e3055c", "value": "SecuriteInfo.com.Win32.HLLW.Autoruner3.12521.4150.32675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa98a37e-88b7-11f0-91c6-42010a9c0006", "comment": "Malware payload (SheetRAT)", "timestamp": 1756898421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898421, "uuid": "66ba48cb-a042-4003-8b73-867b1d0b99eb", "comment": "Malware payload (SheetRAT)", "value": "ea638481264ad4aeaf1b677e4a421840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898421, "uuid": "3c7bec17-a875-4441-807a-034171792cc8", "comment": "Malware payload (SheetRAT)", "value": "24fa73362c2f601aa3016bc38e5d0ca8f5f4d25c37c0ffdc08dc0a022c5e9510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898421, "uuid": "57c3ebb2-60de-4d6e-b573-f4790d24159e", "comment": "Malware payload (SheetRAT)", "value": "330916ad12a9b90504cd4ccde8b7db4c35b96ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898421, "uuid": "9d0a2c51-ce95-46c2-a4dc-019231153094", "comment": "Malware payload (SheetRAT)", "value": "3dd3abe1c61ac1335c063ed77e79d25c55ee356a68fea5602cc130d46820dc6077914cd845820ea94766d10d354b0426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898421, "uuid": "9343fa84-3c89-43ce-a219-ca2db7baacbe", "value": "T18894E50CFE91F805DE5A3D77CBE614108B7125C12F229286325A6FFD8B9937648E25BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898421, "uuid": "39424b2a-3a1e-4fb8-b13a-a5a0d872619d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898421, "uuid": "53103d90-54c6-4b98-8610-13539ac441ba", "value": "6144:SAv2CwcV5jk8wGTnbole3e6VlWT8b9huH3R3eyEybFzujEOb232pl:SXhceGTboePVle8zU3LFzuuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756898421, "uuid": "55fefbac-e0b6-4edd-8fbb-0b5b7c47f182", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756898421, "uuid": "068d36f5-27f0-4e23-8004-4e6c723c5d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898421, "uuid": "8ebdd6c8-ba8d-4f4d-9c6a-8d00d807a85a", "value": "Xeno-3.14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d7bc72-88bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756901718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901718, "uuid": "9ab544b4-cd50-4ec5-ac79-4a06bf03b767", "comment": "Malware payload (Formbook)", "value": "4a3b6ba6129be3ac63ec47f414a39d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901718, "uuid": "79ca3937-1c43-4b36-a0c9-4aa115226d24", "comment": "Malware payload (Formbook)", "value": "268b6fdc221050949a2b624983380cd3fb268fecef2f5bb3a15d91611f3d8092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901718, "uuid": "66429887-89d0-437b-bd57-909f06eb5236", "comment": "Malware payload (Formbook)", "value": "d3ebff2740841addb241bee516946e4ad732099e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901718, "uuid": "1ece1c61-d68d-4d7a-abf5-a7801ee18f3f", "comment": "Malware payload (Formbook)", "value": "18ee733adceac1f74402555ebfebc2fa96d4fff2716079f169297c1a3c830ec0758aaac451f1f10e8739480b02aef62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901718, "uuid": "81fa17a4-1bee-40ce-b97c-8825faa89642", "value": "T17105DF9C3250B49FC8A3C972CDA4DD74A6646CAA870BC20395D71D9FBD0E997DE102F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901718, "uuid": "59de160f-4ba9-456c-a81c-792d5827beb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901718, "uuid": "e0c0fc4f-5046-4337-b054-6b407453581a", "value": "12288:uO2wT0OWTYcI1prLubfX0gulLXzlOZOYB3NTAwBEqZ/6TCsqzak/Y8+dYf1:u7wkI1x+8FLzlOZOg3NrBEqZyTCNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901718, "uuid": "d8b84cc5-2d3e-4b76-9e88-282f16e90579", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901718, "uuid": "c92b9517-a4b6-4fa9-ae31-acaf32f1eaef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901718, "uuid": "ee488945-6a40-4e65-beae-67437af10ce9", "value": "New Order 00041221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d844c2b-88ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1756921028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756921028, "uuid": "adf32f73-16d8-4d2c-a2a8-ac40ce81e22a", "comment": "Malware payload (Arechclient2)", "value": "1bfd2f3590fb00301952cc3162c72370", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756921028, "uuid": "8cc8105b-eedb-48a9-876c-833a533cc8bc", "comment": "Malware payload (Arechclient2)", "value": "272b3cd90243295da28936b5fd521480c8adfa9aefb30ddca5ecbff6c454ba2d", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756921028, "uuid": "bd7d584d-b748-4811-a459-11674be5f21a", "comment": "Malware payload (Arechclient2)", "value": "ef475832e20860dd692d044758f323486a362484", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756921028, "uuid": "fe2d3cf1-5e45-4d9f-a819-12cef0ace260", "comment": "Malware payload (Arechclient2)", "value": "fc9167ff3f5699954d4a995ad2a38900693f96e571c740d4bc7f4854ae03640e6f35e1595c4c0cdbabaff1051c81671c", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756921028, "uuid": "883a7aca-c5b8-4b8f-a534-1249dce93d73", "value": "T154E6B583EADB9EA1C6062FF6C657A110C311D281B773E70E255B62272B12BBE57453C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756921028, "uuid": "51a93ed4-eaea-4e22-9210-1b4afcf3f813", "value": "98304:h9F/h26spdQ2R7VAwWVn8UQjtUEyViciZ74Vl8IQ7d1HNgrs75hWdQXMF6Ji:jF/bspSvn8UItsViciZyOnK+vWdQy6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756921028, "uuid": "a54d94ab-0180-4cab-a7da-3dbc5b168a9a", "value": 15154176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756921028, "uuid": "6c01c9af-6118-4e24-8e8a-90b2486aa888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756921028, "uuid": "110e8eef-a2cd-4826-bdde-506b7af6c66e", "value": "Microsoft OneDrive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afaae92-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929963, "uuid": "c437590f-73bf-414d-baf9-c21f22c636c8", "comment": "Malware payload (Mirai)", "value": "7f44850acde7a44e4a43d2d0c44e244c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929963, "uuid": "4ed564df-227f-4f7d-8a2e-3607db918a7a", "comment": "Malware payload (Mirai)", "value": "275e41238fd82508164cd2ecd95cc16a198dc6a28842ca94556b62fb53cd2458", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929963, "uuid": "6c6e94d4-022b-4be9-b4e4-7f75fccade8e", "comment": "Malware payload (Mirai)", "value": "d7a466b1ec9c4e46cd174ee50b2a9aa3e844b0a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929963, "uuid": "959acb4e-0cd3-40f6-8b03-17c208489583", "comment": "Malware payload (Mirai)", "value": "8de00b064f0faa577e263ef252c23fdf9dbbe065bc5d81cee949a2040de6e1073b2a1ece4e0e68679ba6f8e86f50c2c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929963, "uuid": "fbf99559-a25d-4968-96a0-02c27b106495", "value": "T120435CC59563E9FCDC1019353077FF7256B6E93F1028EBC7D7A8A932A981A02D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929963, "uuid": "d42d41ff-2e60-42c6-b586-cdf56f1d3b61", "value": "1536:36Ew7pWKbZK2zpVr+3UJwvimWTF+7t+Rc:CdWAZK2zX4lvimWp+7QK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929963, "uuid": "ae2b3089-c092-42c7-b274-1f8f2a3ebee5", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929963, "uuid": "8e62ae4d-c609-4e15-9480-6ca8d99fab80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929963, "uuid": "2b581fba-b376-4f94-b7fd-82d635db059f", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a4e0cd-88bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756901552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901552, "uuid": "e3481228-8db0-4190-b022-377724b603ff", "comment": "Malware payload (LummaStealer)", "value": "0b4f1b8504ce1493015a14fdde6ae40e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901552, "uuid": "a63fdabd-71ef-4f0c-8920-c29078cc92c9", "comment": "Malware payload (LummaStealer)", "value": "27d39dc24dabb7ba6199fb3cc3f2eb785fd202d7f11010e4e5b16de1ffbab4b2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901552, "uuid": "1d04426d-6768-477d-9ec2-9b583b917d79", "comment": "Malware payload (LummaStealer)", "value": "534b841f39e81283833cefee235d6981f413b68b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901552, "uuid": "6bf708e3-cba6-4992-b502-2fee0be1642e", "comment": "Malware payload (LummaStealer)", "value": "3448e84c54c04a093b10d4b6b97ce43a6b80f4b81841f9438610fde70d3985667cf6a43cc035ff80054f4f595c727fc8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901552, "uuid": "6c51dabb-fe07-469a-a49e-dd22c5c0e29b", "value": "T1C68533991F7156AFC00686F7108B3AE27A2823840E76663E7741E64D42FF3AFD936C54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901552, "uuid": "47bb9bb4-68e8-4130-ac16-75c6a04e7b58", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901552, "uuid": "e6c72846-9164-44ed-8f2d-ec062a6751f9", "value": "49152:9t484aKqBQvvMycfUqak30CfBUSGFFYT:9t/jBwJcf1XBUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901552, "uuid": "c127fd98-44d1-46f2-8c5e-c3663af61d56", "value": 1793536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901552, "uuid": "1abb07f9-c6a5-4d04-ab50-97f13596222d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901552, "uuid": "2a9a38fb-dd12-4bd2-bd17-19fa3fceb8ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9435f396-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756872050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872050, "uuid": "48c8b647-a858-465b-9a5e-0e4eecd8db34", "comment": "Malware payload (LummaStealer)", "value": "8da547318ab0fb627937472535ccbc82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872050, "uuid": "a5c3a441-be20-4199-a62d-96e2fea689dd", "comment": "Malware payload (LummaStealer)", "value": "28935c2d473fd73a307b70be48b5be81f5a25a9c636841e5e60b981f26ded3cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872050, "uuid": "48e3c56b-643b-4cb4-9984-bcf278f6118e", "comment": "Malware payload (LummaStealer)", "value": "9089f64cea867b4b292b890a7051b66ebefa6173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872050, "uuid": "46334ddb-0218-4b14-9718-b9257f71e10f", "comment": "Malware payload (LummaStealer)", "value": "50bd28af24352843ca7d504bb8034266abd60f0750706c4cb86511bceb5697c0d3985e95a37a0f3027d22fdfcb4a7ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872050, "uuid": "e937d26b-bcd4-45a3-a9f4-a77b6ca90e12", "value": "T1C235233FB5984831EE6256F28D3006AEB5FFB9290530E82563C574CD7527663C9B238B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872050, "uuid": "1c3f1081-887c-4ae5-863e-44546021257f", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872050, "uuid": "0e5c6fd4-5876-4cff-929a-84c7d90a1947", "value": "24576:iiQw0tQH7CYynfUiM7asHzjbo4nwXrLfKa3IXngeAT8Wc5Wc5dYej:Vt0wzoUdaOPn4LDIXn3AT8WHczYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872050, "uuid": "8428eb6b-280b-4aea-94a4-c6d4054ad1c0", "value": 1134400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872050, "uuid": "217d2263-aab3-4a51-ac3e-8ac8ad4f7d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872050, "uuid": "068a2ac4-57ee-4db7-aace-b76862cb797e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e16c39a-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866778, "uuid": "4d6a2ebf-d469-424f-8bc1-edbd28e5e53c", "comment": "Malware payload (Mirai)", "value": "e5ce913e5ac6f7b0c98acc17af50bf04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866778, "uuid": "adbdf4ab-d73e-4d1f-b84d-87716789d8fd", "comment": "Malware payload (Mirai)", "value": "28cf61adf6938f73cb7129a32360fff69f74c728f143160d0bf309fa07a9f489", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866778, "uuid": "e0977ca3-bbeb-419a-8175-547c8dc7253f", "comment": "Malware payload (Mirai)", "value": "6100c86f4309e3f73fff70ea1bad3c5b7b7fa799", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866778, "uuid": "49f24261-982e-4535-996a-756518b8dae4", "comment": "Malware payload (Mirai)", "value": "508cd67511f521cb0c892d7460fb17de1fc8551df5179c18b1a40df8b1a55581673b1d279930f5e0ce456b5e1a88823c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866778, "uuid": "dd822558-97ba-4e01-a0d6-16e6b3392750", "value": "T171334A26AE7A1E17C0D4A47A62F34329B2F1131F25B8CB2E7DB20E4EFF1554461176B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866778, "uuid": "10831935-6231-4ff9-b84d-3c134e5ba4f9", "value": "768:6Kovq9WU0SosBG3cvw8ak1r3lJJR2HUfoO+o8IqGqsg:6KOSWlSosBGsv/r1rVJJRwUfio1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866778, "uuid": "bb995965-62b0-4466-9c1b-79a117e98ef4", "value": 50884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866778, "uuid": "9d122829-ec19-4ccc-880b-fb0f3bd8b863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866778, "uuid": "ca4c226b-5592-4129-bfb6-2454556a16ff", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a74093-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (MetaStealer)", "timestamp": 1756923268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923268, "uuid": "a811d163-6ab3-4f58-8984-e2649d8dc4dc", "comment": "Malware payload (MetaStealer)", "value": "d8b41f8f9f446f9b89bc74651eabef64", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923268, "uuid": "ef33950a-b1e0-431d-b77d-0813f7001177", "comment": "Malware payload (MetaStealer)", "value": "29cc70f9303aa4a186d3024838cd0b4b68324739115b42fd49c2fdfc6b02d94a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923268, "uuid": "11c4689b-32d4-4686-b7c2-d1cde0d25617", "comment": "Malware payload (MetaStealer)", "value": "bd8e2ffbedbaa9e583b8eff436286f7395a9d0c8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923268, "uuid": "f32ad6ac-fbc1-4378-a2df-265baac4e9e3", "comment": "Malware payload (MetaStealer)", "value": "ad1293413c05de57ef6a76b834742483e08f6ce5e39e8b9cc0a9fd24b8486adc8009b9c0ac4d1cf7a9eb31b891c4725f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923268, "uuid": "74707cb0-bb3c-4c5a-a181-2b623ead2886", "value": "T1EB51D9153ADD4339F3B24D3A04B5A611497FFE86ED258E0D42851A4C5C66B00EC3AF6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923268, "uuid": "9b9c5457-2db9-44ac-a64a-9511233119f2", "value": "24:82124J8nwFWeYh1AVx+/5+wxAZn6wGlqdd+5CwiXuHY8o/fmI:82121nFevqHxAZntRdyRiXuHGfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923268, "uuid": "621f181c-d12b-444b-9fe7-7f78fef2a676", "value": 3089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923268, "uuid": "8aaef8b5-b3fe-4410-a6f1-579dab6c01e5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923268, "uuid": "592d176b-f02e-4b56-8831-78312a68d345", "value": "address-validation-guidelines.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcac9c7a-88de-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756915175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915175, "uuid": "f6d11640-ba64-4b9b-9c37-592170f1be40", "comment": "Malware payload (Mirai)", "value": "e8de907038959aa750008163e413d64e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915175, "uuid": "1a2f51e4-b927-4335-92ca-9d110da59956", "comment": "Malware payload (Mirai)", "value": "2b6c39001f95892a3d149c5b85f4233a316a4aa771a251ca0645ee20243aed51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915175, "uuid": "c3c51789-f2c6-45ee-b62d-b846eb65fd30", "comment": "Malware payload (Mirai)", "value": "8e07f902b12e3941743dc20306cbae30fc0d40c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915175, "uuid": "d032f426-7ab7-4b56-a0e1-6e69125a484b", "comment": "Malware payload (Mirai)", "value": "3b1c9f4b9490bee958d1c374632f053f838d419e68ca289a980ff97be6156baf4f765feb5d9163a0b94f48b4d8d20c33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915175, "uuid": "4d88042d-2736-4882-9f85-d8148536a4d0", "value": "T17F832A41FC81462BC1D102BAB29EBA8D3B6113E9D2CB7217EE204B203AD559F1D76FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915175, "uuid": "8616bcc8-2676-454d-bd66-9a516585f307", "value": "1536:ok7pjM1fQP59ycJ9DVBwgYDTTY2vs8ZXdLmcfzPVHvH2IymQY2AUm6hh1HX:ok75M165cm9DVixfT6hh13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756915175, "uuid": "cfce6d6b-9c40-4688-bc63-140e6aa57e49", "value": 84256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756915175, "uuid": "e7dc6d35-c661-4765-817f-b94894a48c65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915175, "uuid": "1fb089f5-544c-4fc5-831f-a1b4e020f35e", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535190a7-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756871941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756871941, "uuid": "55888477-0530-483e-8670-2e11e10c630a", "comment": "Malware payload", "value": "0d92fc3c029a3eded59f313a2a061a29", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756871941, "uuid": "a72dbd61-eac9-4a79-aec4-6807502d1fb0", "comment": "Malware payload", "value": "2b7019290ecc3626e55f971dbcd3b1e83f127dae044271be8d7ceac90a216004", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756871941, "uuid": "b69a7ccd-e03c-4f81-a242-92ef8321ee79", "comment": "Malware payload", "value": "009a96011047b075a3d7c7482b2cdb43b5104d9d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756871941, "uuid": "e4089d19-3092-4e85-b87b-84813342f8a4", "comment": "Malware payload", "value": "c57844dcb1bd729477cdb7ad125c1ecb1ebf1d7dde358bc5c1c39643f366d4c2ccbe49d6e230a5f8a0a59793b5f19563", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756871941, "uuid": "713120db-80e2-4e84-9639-6bf6b26589af", "value": "T1EBD5BD8AF748AA6BC4F753324D399A6651074CA68F83D7837948733C59BB5C40E0AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756871941, "uuid": "eb8b0d9f-1601-42a3-8825-736634a850fa", "value": "49152:IoqQHYf/v7D+GEfTirSHOT2l2y32oaZiZLsW/b5SEVw8O2FXfX6Cx8bM1:IoqzfrD7wTa22y32oaZepb5VwH2FXvZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756871941, "uuid": "d7a6f4ad-f443-4bbf-8261-02addd14ea40", "value": 2924752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756871941, "uuid": "8f24204d-938b-436f-8101-c0928278517e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756871941, "uuid": "9c1141f3-29bc-4dba-a08c-c3c52a3b1cad", "value": "card1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4bed85-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929961, "uuid": "5513af65-b0e9-47e6-bd45-daf79b08d3ee", "comment": "Malware payload (Mirai)", "value": "6b3a0b8169a57fc0b4a709913cfe12fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929961, "uuid": "2478bdfe-63c5-445b-9d23-8595cfc2021c", "comment": "Malware payload (Mirai)", "value": "2d82f6567b84dbb64ec058b5adf7f89341677d3e434cef11c3d064a8865d820e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929961, "uuid": "a3cfd2fb-d17b-412a-80dd-3e1d3abdd14c", "comment": "Malware payload (Mirai)", "value": "732332ac0e542a6bd1662a1c8462778512403bb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929961, "uuid": "7289bc45-545e-4eca-acda-5fee18f5e666", "comment": "Malware payload (Mirai)", "value": "5147e4632bc049ba97aaeb8a243b9fafc16c3217ea225965e13c642d2e5fc101e9ef5508f4b8a2dd8650571446970b4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929961, "uuid": "fc5e6fb5-b1f8-49ec-aed1-faca0134e980", "value": "T13D63954E6E719FBCFBA8873447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929961, "uuid": "80e39f66-e38e-4860-be10-c005893bb508", "value": "1536:D8aCKgFqz+SIjtr3st2jpoJtFH+j7rt9K01eeK:QH+kJr3fCJtIj7rt9KkHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929961, "uuid": "6065c1e0-26e3-4217-aa4d-fd4f6d1a084d", "value": 68272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929961, "uuid": "69ff3b47-8e90-478b-81da-9a610f7fc717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929961, "uuid": "b16212e6-14ae-4da0-b04d-53078c9031c9", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafca08d-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756891952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891952, "uuid": "7a3d29ef-54f1-4878-99e8-ec9dedb2e02f", "comment": "Malware payload (RemcosRAT)", "value": "ccbccbea58806dc9f8a24352d7038e4c", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891952, "uuid": "c0ad79d1-aefd-4470-b0e0-a37807fb7a0a", "comment": "Malware payload (RemcosRAT)", "value": "2d8333812a01bcf27895c943e9dea10bb0007a775941ed45855a3f741b36bb36", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891952, "uuid": "91f5ca6a-d017-41b9-b9c9-452a9f2ec17c", "comment": "Malware payload (RemcosRAT)", "value": "95c1e1a011854970ed4f02a68eae768a7dedcbe5", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891952, "uuid": "fa2c309b-09c3-4e2e-8b27-33158a1c3ac5", "comment": "Malware payload (RemcosRAT)", "value": "6cd09aa0e8fc1f63b3714abaf0d6359f87f9874767362f0afd39ce829de00bb815c890f2fd89be3fba842b12e2dd05ac", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891952, "uuid": "a8540a08-eba1-465c-84db-26520cd7ffc3", "value": "T14DE4BF39C52BBC9B3E1E1D48D80C2C835D680DC7C668E664ED8D51A77ACCA529F6C4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891952, "uuid": "bab133de-bff9-4023-8fe1-56bab5d2fa7a", "value": "12288:nm+arw4ADmYQ7Na/KllKNIiA3doC6At9tXmSpbZj7c30jgoPjWp:m+ayDmYQpa/KqNgyAt9AKo+gNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891952, "uuid": "914fb891-9cb2-4346-ac25-4a7928aa7229", "value": 690748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891952, "uuid": "d7618652-1a78-451f-bb8f-c4b385cacd1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891952, "uuid": "e616eeca-0472-4d1b-95ae-9c4755da45aa", "value": "REF-ORDER SEARAY FOODS REQUEST-7399 -7676.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd85bae-8872-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756868687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868687, "uuid": "045719b8-f332-4571-8f7d-51e2e2655e5d", "comment": "Malware payload (Mirai)", "value": "8379c3dcac23e40947032884e4c9991e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868687, "uuid": "7a9ab148-bff3-4a3c-b867-ab3b1bcff630", "comment": "Malware payload (Mirai)", "value": "2f535bbb55dc9055a00506ae743343bd4c595a0cbe3967d6b19834cc6554a402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868687, "uuid": "d62f64d8-9cc0-4dc3-9938-44da5358ee5f", "comment": "Malware payload (Mirai)", "value": "732989d30fcb3e23308a61b6d93ee69f13b2a557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868687, "uuid": "a5986b11-65ce-4e47-8f85-e796009b50e9", "comment": "Malware payload (Mirai)", "value": "9a4a44fc8232b9c623c813bafa03f3df322b1e1d7579268032e028778a904792668ed253fc84367eb35683b87cbe8be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868687, "uuid": "4e9e1256-8d4f-4335-87c1-71190b31237b", "value": "T19193B60E2E219FBDFB6CC2354BB78A34979963D627D08685E27CF9105F6024D640FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868687, "uuid": "4538a710-5adf-4220-a805-a73139006c28", "value": "1536:+OVGmypYzjKpKc1iIhMxB8BRRelTWYwa4bnAuJSPT3PT9FPT4rHynkM8O02VCKfW:l9ypexBQRGFwaqAuJhbO0oCocnNtfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868687, "uuid": "d4585bfb-625f-4647-8203-f529837f6097", "value": 93708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868687, "uuid": "879185c8-c55c-49b1-96fa-4af7e9c41695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868687, "uuid": "37ed4c3e-6215-4990-8be1-dc3c6004b296", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4acb59b5-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866773, "uuid": "71bd8708-8fc6-4742-a1e9-cd39cb0a5d30", "comment": "Malware payload (Mirai)", "value": "d4afcfb9c83bdc595be063050f2f746e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866773, "uuid": "c3ca7898-72c8-4f42-9b24-0ea8c94f92d9", "comment": "Malware payload (Mirai)", "value": "2f67aa92d1bd836e1f84933fb5c6d91802043f31c577bc79f9c3afc755421690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866773, "uuid": "9ef00e05-8a98-4b5e-9db1-dc0145e0ac66", "comment": "Malware payload (Mirai)", "value": "261b0710e0eebd9c1b28c6a78538cd4111b3e3a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866773, "uuid": "6e2b60d5-f500-4ebc-b098-80353b5ac7eb", "comment": "Malware payload (Mirai)", "value": "e230ed9186aab239c1a1d1e67a452392a2cb67ef9f753283033166a6b0f1c4ffabe4b950d31d4436e50ea15eceb49ac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866773, "uuid": "f0848201-0c14-47ff-9b07-cb7d0af50e11", "value": "T10782CF3061AB74F9CBF10431FAAECEC6971A0BF8D1FC329216586B78C94510661F93DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866773, "uuid": "fc94d498-5ab9-4032-a016-d436ecbc1a14", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa1hymdGUop5h5lG:2dV0P6+kom0tVAoNvm+to11s3UoznlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866773, "uuid": "2045f118-4476-4a84-aec7-2a06fea26534", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866773, "uuid": "0059c91c-d5a7-46c3-8eed-8a9eed15e912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866773, "uuid": "9003db08-16cf-48c3-a525-a001be372f46", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c525938f-887e-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756873850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873850, "uuid": "e9ee2436-a5b0-4670-9622-805fa61b62dc", "comment": "Malware payload (LummaStealer)", "value": "4002ede4c247d7cae6ea1d7c5974d2bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873850, "uuid": "cba75400-4a6b-4d3d-80b5-12b66612c614", "comment": "Malware payload (LummaStealer)", "value": "2f9552fb6f1ff04da4df4799337be64da7f8dfe06035d528da32233bc7b50afe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873850, "uuid": "2d222fae-6c35-49af-9704-9f9df47fcbd4", "comment": "Malware payload (LummaStealer)", "value": "6944489c61621480e5f7e0975e39d3f2460640b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873850, "uuid": "4df96168-a5bf-45de-bc8e-90f1516f4b08", "comment": "Malware payload (LummaStealer)", "value": "54a364d03b163cef696ceed826145b3cdca2f125a2a9390559731579d695070e207338dc954892f2c830a9bc4ef0ce0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873850, "uuid": "c6d557c4-c507-479d-b64e-fbf598829b89", "value": "T17C45D018AC7590DAFCD340706B769112E533BD3BCB242AEB51E497512A17EED0E3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873850, "uuid": "ba9d058a-6b10-4d32-b842-d1bb83a4287d", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873850, "uuid": "a62127a2-7f92-4832-a724-b82502e654b9", "value": "24576:7UYxEL+Rbj/0c9qx6rFdmJYPCJlMhaUdzt2DRkBw9vxzyAi:7UAE69t9qsF40dztsGw9vUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756873850, "uuid": "ed977305-6cd9-43a5-9cf3-b8f6feff7197", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756873850, "uuid": "55730388-9021-4e7a-be12-27dff7a57b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873850, "uuid": "8173a567-f7b0-4b31-a388-8bb07a046b98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59626b8-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756923270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923270, "uuid": "b81b4d58-806f-4bc1-8d4d-eae4791a1f83", "comment": "Malware payload", "value": "60ac7f54aaa2f6b4b51dca6c49b7cd60", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923270, "uuid": "c39edf1a-fdb1-4571-979d-0135f85d3a98", "comment": "Malware payload", "value": "30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923270, "uuid": "6cd546df-a6c3-4a2f-8b58-d54e664180c9", "comment": "Malware payload", "value": "8c72068cf5cb5caba18238dbede4f94d6d74461f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923270, "uuid": "36a22e47-59fc-40a6-8d98-e3e608575543", "comment": "Malware payload", "value": "84cb3cee8fa4883511d86ad2d2033a805aa1849b317ad617aade614d40f7ff2b358f53e1fe4b1c7e1295d496327d093e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923270, "uuid": "aabae555-f6ee-409d-b0e8-063681f5e7e9", "value": "T198A474D1F6A736C2ACC0CA57A750F6F8A13710B2AA465531D3FCD72AD0700679BCD9A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923270, "uuid": "29bb38c8-f941-4d17-8a30-42d0a160881e", "value": "6144:OusDDBfyx5+1jdUrSLk/6uvucusDDBfyx5+1jdUrSLk/6uvh:/shyx5L0k/6Vshyx5L0k/6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923270, "uuid": "080ac9af-7fdc-43b9-9b0e-4235463f2d33", "value": 466300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923270, "uuid": "b3b8040c-2ab5-488f-a96f-194d77038eb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923270, "uuid": "4405f570-141d-4ae2-b6c5-b907fab8a563", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2dfd3b-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1756891796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891796, "uuid": "6bbf0e77-fe2e-4ca6-8e14-660611f8c2b8", "comment": "Malware payload (AgentTesla)", "value": "a139d7da3613f2bc7d5659463869857d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891796, "uuid": "a53db688-94aa-42cf-93a7-30f8aa840500", "comment": "Malware payload (AgentTesla)", "value": "30d390798921ad884a663059d84802c5ab2fd415e343453ad2a47100d559fe29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891796, "uuid": "454c50ed-cc00-4e85-b06e-d5829d5e2e79", "comment": "Malware payload (AgentTesla)", "value": "ecf3dd8fd66dc1c8b1d0e88fadd0dbc70ed2cff3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891796, "uuid": "bfe3aa92-53d2-4e74-b900-2f46a7ccf2e7", "comment": "Malware payload (AgentTesla)", "value": "3e85b96b012b7e67ca97483e29c7fd90a15e96dab1c8ead4d88c81e955e398bbe483a865930f49b99fb60f2ba9e5d849", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891796, "uuid": "c179bae4-c45b-493e-9519-b9b219eb5895", "value": "T1C918AE027391D062FFAB91334F5AF6115BBC79260123A61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891796, "uuid": "dacb55f3-28cb-4521-8222-734b0078f3ca", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891796, "uuid": "4be5f61a-030d-4384-87a2-ea4300b64bf8", "value": "24576:/5EmXFtKaL4/oFe5T9yyXYfP1ijXdaqpMCJPcx9O:/PVt/LZeJbInQRaq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891796, "uuid": "629cf363-da06-4a52-846d-c7ab8a578c9a", "value": 93323264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891796, "uuid": "12681bbe-00df-4063-935e-4e69b26edf68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891796, "uuid": "463b5f6e-7b92-4866-b5a0-e04311e2362b", "value": "DHL GUIA 1Z4815906897663406 Confirmaci\u00f3n de env\u00edo 1Z481545456666340634674.bz2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072ca9e8-88af-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756894576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894576, "uuid": "a12dec98-a4f1-4a9c-b093-d974044d0afa", "comment": "Malware payload (RemcosRAT)", "value": "17810f72e40767287a21474d046a327a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894576, "uuid": "737ba541-bcc8-45d3-8a8c-86d7f19db191", "comment": "Malware payload (RemcosRAT)", "value": "31a41ec300e4c59521f0e3dd55191a602e20594eeac4c6c7d3c7022a90691cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894576, "uuid": "d0bfeba1-cf03-4b30-8e9b-cd7a2aa8784b", "comment": "Malware payload (RemcosRAT)", "value": "070a743f1628bc273e7a58a012db2c706ff463d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894576, "uuid": "888776e0-11f2-4bfc-823f-59c835dd29c8", "comment": "Malware payload (RemcosRAT)", "value": "1a13af5163d2e89daeabfcd78fcde56e785b28d23c854e08d1433e95f5644150843768a669b939ac4c3bbf0a4754e998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894576, "uuid": "9361e458-a083-4913-b180-20d72e339471", "value": "T10233490CEBCDAA72CAAC4ABFD8F2B6904B79C0F5E747E307248419150A177DB5801E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894576, "uuid": "3098e942-5ca0-44eb-93b5-45283c2e0105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894576, "uuid": "b322e154-69fc-46d3-8700-a297f9d33c28", "value": "768:xRu5Fgi4inumVNz917J7URzU3FPu/H0ryyapqoo1Pc1/ZnEzwKllCV:7Euipj3UW14HUBwLog/a8KI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894576, "uuid": "8d96a7a7-ffb1-4b36-91bd-52e086fdfc28", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894576, "uuid": "28e9acf4-1470-4559-bd01-987d19fcb355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894576, "uuid": "8a090e99-6b1e-475f-9af2-72f04be9fa88", "value": "RE RFQ Resend Doc2805079915 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b4b63b-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929974, "uuid": "f7bbd28a-8d5a-4127-8991-39e545c2d40d", "comment": "Malware payload (Mirai)", "value": "047df61991ac4584ee3ce7eb29ac536c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929974, "uuid": "20c94dcd-9643-460c-857a-946acbcc3327", "comment": "Malware payload (Mirai)", "value": "3290985fd7dc87d01922bfd0e8c584f575b8375cc8396b3e1d465fdba714c16f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929974, "uuid": "91ed8219-37a8-4654-a75f-50d096152f74", "comment": "Malware payload (Mirai)", "value": "e07bb9e4d6c6687c76dfea7ec9c8c88a25de0ee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929974, "uuid": "37bc4955-568f-4bbc-84af-45bd9a7ff7b5", "comment": "Malware payload (Mirai)", "value": "2aef825de9ae496f6048dd4b0b8f5c2245933eda66d37fc2cb1e6d99ca8f2a5704cf80405e793a012c12711d55c3bc48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929974, "uuid": "98f463f6-1643-4d29-8c24-2851d71d3cef", "value": "T14973840E2E619FBCFBAD863587B34F209248339226E1D545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929974, "uuid": "01cd4e26-7d6c-4035-a2e7-3e9cf4a96fcd", "value": "1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXwptWdN63fJjzET6:B6ry6+vdGIdysUKVWdN4fBzI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929974, "uuid": "98966e41-9ac9-4ffc-851d-4c30692229f5", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929974, "uuid": "f10e5108-2c9a-4885-90d9-5322474a7583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929974, "uuid": "888b00be-4d16-478c-813f-2f597318fa9d", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebfdfe7-88bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1756900924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900924, "uuid": "4b25d919-57e8-4f54-9aad-c67444dd5f52", "comment": "Malware payload (Rhadamanthys)", "value": "f15f62eba6b7aa76700139474d15a2f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900924, "uuid": "8ef00d72-1f36-4dae-bf44-52bf19681813", "comment": "Malware payload (Rhadamanthys)", "value": "329fc71ce853cd0f6c4a4f346681639de2173f6dfd888fcd4497cc7d73ac2f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900924, "uuid": "f04c3da2-31bc-4bb5-8262-e5559d7eebe0", "comment": "Malware payload (Rhadamanthys)", "value": "a30abb894ca20a0da4dc4685e7a8757f671e7f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900924, "uuid": "9504043a-ab47-4396-89e9-cae6e3b206a6", "comment": "Malware payload (Rhadamanthys)", "value": "a9383e80865abab2ffc44bb99352b885662a8288dc424e91b2ccb3d1e9a9f9d74285bfcc5839d6c15ac061436d033075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900924, "uuid": "25d036c8-2ddb-4398-bb1c-abe42f3c378c", "value": "T14B65F118AC3590DAFCD344706F7A9112E533BD3BCB246EEB51D49B511A06EED0A3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900924, "uuid": "6eb41798-613a-42d0-86c1-a0431ce13bbb", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900924, "uuid": "10980e80-cdde-483d-8eda-759761efcb9f", "value": "24576:7UYxEL+Rbj/0c9qx6rFdmJYPDR0XcW/pLAfdB06YLQIut:7UAE69t9qsFwcWBLaB068O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756900924, "uuid": "df281885-cc77-42f5-9fb5-0882d9743cce", "value": 1509928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756900924, "uuid": "4ccefe2c-d49e-4351-8a01-97efd526808d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900924, "uuid": "dc6fc7ac-aedb-4220-818d-2285f17a7a44", "value": "Arly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59673e57-8871-11f0-91c6-42010a9c0006", "comment": "Malware payload (Xorbot)", "timestamp": 1756868086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868086, "uuid": "bf55c72d-2436-429c-aa4e-1e10acf92ffd", "comment": "Malware payload (Xorbot)", "value": "dfe713f5427d57d59c43a553cbbadaa7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868086, "uuid": "6ce2b30c-f796-49c5-a142-4fcb53e9dd55", "comment": "Malware payload (Xorbot)", "value": "33d295df2b9d8c401abfb35685829ca37180c4b8add9437d8b2232358172f527", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868086, "uuid": "be24313e-b569-44c2-9fee-f92d2a7dd7b6", "comment": "Malware payload (Xorbot)", "value": "37e792844fd62a2615aef3b76927fc0a5cc958b7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868086, "uuid": "0450b200-aca8-416a-9ac2-ccd78cdd3632", "comment": "Malware payload (Xorbot)", "value": "4365b141790b983a3014baf8037f0651bcc4d059ba30444ca56f05f7ea6c18a3366f5c953a8f5bdf6aa7058ffc4b23e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868086, "uuid": "6256628c-effa-4a2a-bb5a-ed09d820d15d", "value": "T1032201CDD6E0B2301C6EDDA97AB60214F2781682B5C31F14DBAD28D5C6CFF49B54AB12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868086, "uuid": "cfebe94b-a72d-4e03-b508-662acd48a46b", "value": "192:1c0fE4DO2SGr+mq2k4Yec0fE4RbSGr+ml:1c0fE4K2SGr+mq2k4Yec0fE4ZSGr+ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868086, "uuid": "f3eab18d-f243-495a-a3e8-dbdaa1be4263", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868086, "uuid": "103bb01a-ba70-4ac3-a304-83562d65d64b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868086, "uuid": "521bc94e-77f4-4200-b274-2d834d90a012", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9fd593-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872678, "uuid": "f4cd4a36-2b45-4584-9b64-4f084bd9e7ef", "comment": "Malware payload (Mirai)", "value": "9703378045a6a70be59b294097de0fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872678, "uuid": "63b7c8ab-202e-4c16-8742-e4d8af646900", "comment": "Malware payload (Mirai)", "value": "3570cfabf0317d67d7c118160783bf1fd42397f798916c66c1fac2132a0fb6aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872678, "uuid": "f58a119b-8878-41a1-b4eb-3a07b9dc933c", "comment": "Malware payload (Mirai)", "value": "c6f74dc2268c3f0ab58f8746086de7e665256cf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872678, "uuid": "063781b7-be21-4d09-8ebb-fa38f76e04a0", "comment": "Malware payload (Mirai)", "value": "e87274f604b3b62e5f0091f258ef192fbe64b3a3221b34a0f44237c5f41fab2ee8548e847e2a4274498ff1c2e92d9e1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872678, "uuid": "0d4456c6-4c01-493b-b563-a3cf0dfd6e8e", "value": "T13121F100F21D4813E5D17E7073371B5067BA8F03161D4A089F9FE699D9B8C315E4D49C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872678, "uuid": "4912718c-0498-4f93-a592-95c59b692146", "value": "24:3KopWS9nSWZ6S4/KSwISBd6oTKP5tAFlD25oCqzktqBAvy5/aaTo0YiSMsRp6VF:wgZVbXGAuoXz2qBAvy5/lxspKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872678, "uuid": "a5e326a8-47a5-42c5-8c2a-79b04c32db3b", "value": 1400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872678, "uuid": "746a9831-2ba2-4eaf-8505-cc347dbac9c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872678, "uuid": "a0913d58-110a-493a-80a0-93f7c02d783f", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3969089-885d-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756859728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859728, "uuid": "04acc7ec-a67e-47d0-b3a1-391720e57365", "comment": "Malware payload (LummaStealer)", "value": "894623e183700ddfb102c3533517aaac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-cheat", "colour": "#F23860", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859728, "uuid": "3f83decc-8225-434e-9204-76401d17f9ba", "comment": "Malware payload (LummaStealer)", "value": "363b64c2112bb5876b55d4cf247f0437ffd3ca5aa1d0b7390a8e2873230d5dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-cheat", "colour": "#F23860", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859728, "uuid": "597ab69d-4d6b-44ac-933d-48db2fa64797", "comment": "Malware payload (LummaStealer)", "value": "385ad6ca1e1e6d8e1d61249bf99ee24da52f4f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-cheat", "colour": "#F23860", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859728, "uuid": "160f15ef-5f40-417a-93c1-8765c0a44e75", "comment": "Malware payload (LummaStealer)", "value": "c076336ced5bb7eeb5a30a44dc5b0983582cf6bba2e9549fa0ba6e1e9ce428d17e65df236a518215f5125481b8ab70db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-cheat", "colour": "#F23860", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859728, "uuid": "4a3fe093-0923-4b09-a6f2-f699e74cf560", "value": "T10745E018AC7590DAFCD340706F6A9112E533BD3BCB242EEB51E497511A46EEC0E3E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859728, "uuid": "44985c74-8994-4684-aa9f-7613f0ae1464", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859728, "uuid": "1c52ebbf-2252-44fe-a4a7-3bfc9a090c11", "value": "24576:MUYxEL+Rbj/0c9qx6rFdmJYP4BWFvmEtbCat:MUAE69t9qsF9OkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756859728, "uuid": "90d5138a-54b4-460b-8bfc-ce7fcc30315c", "value": 1267752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756859728, "uuid": "b86148e6-ec55-4249-b934-3de32ab33b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859728, "uuid": "cf3a81c5-789c-4ec3-8f24-4589bdffccd7", "value": "Galaxy Swapper v2.0.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d62aaad-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872683, "uuid": "ddf4f130-d9af-429d-916b-40c28f66b026", "comment": "Malware payload (Mirai)", "value": "d4aabce4fa996e206622fc2587be7a82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872683, "uuid": "1405ae9d-4d74-4afa-888d-979773a14e7f", "comment": "Malware payload (Mirai)", "value": "36bf771c5cc7cc5c03d2dea37c2e09026395665b66d3aeae9b1c2d0f9de690ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872683, "uuid": "547dd2f9-0296-4020-9705-6eb49981d7cc", "comment": "Malware payload (Mirai)", "value": "4e714976bf0dbc4682dd6b0fd499973608bbd622", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872683, "uuid": "876e84b1-2197-4f93-80ce-e67d30e119d0", "comment": "Malware payload (Mirai)", "value": "82009e7552d3c5250cf4c8a695d598f7e2244f4d002ee14ab9e93ba8e327a1ce7f7a0f201ef75ff1ec5b6626a028a3c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872683, "uuid": "d3bae6b5-3e2f-4b40-a9f8-f3074d15ae51", "value": "T1044112491FD01F33DDA6CC36464B2B512ACC802BA16A33966334DD60BD3EA05E7D38E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872683, "uuid": "3146ad35-5ab7-4fa3-8bc9-fde81d1b9ede", "value": "48:EQ2finuDW3s6df9++SMTLWPkeTLGxFWXp:EQkinuq/f9DSoLW7TLh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872683, "uuid": "a853c527-d993-4637-bb27-a5d56748e6c4", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872683, "uuid": "982a842d-65f5-418a-9af7-7a32782d5b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872683, "uuid": "f7d77d9e-46f3-408d-bc28-d05351a8910d", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498fdd60-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866771, "uuid": "5ea174be-a701-4eb3-9b67-b1d9388a388c", "comment": "Malware payload (Mirai)", "value": "fa495779ce9866b501af76cbd1788f55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866771, "uuid": "3923ce71-d9e5-452f-b48b-93e4d99979f0", "comment": "Malware payload (Mirai)", "value": "37b1f5bbabf15c0526eeac0c6a964c32709a5e337e6b4f74cbffa38a79432678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866771, "uuid": "65284037-318d-4bd9-9c4d-2673d13f596b", "comment": "Malware payload (Mirai)", "value": "45661e7cf9f1f1fb9361a263498f8f62fb1c8b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866771, "uuid": "c9c1d363-88f9-450a-911f-2b50aeae5fff", "comment": "Malware payload (Mirai)", "value": "0d8185926bd33cea22705dd97e730a770db68739de6893d8cd79c75e5c4c893f06a701f3ebff1c61f05e845fe69e8b3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866771, "uuid": "a08d09e4-57fc-48f3-8cc2-2f49e14fac91", "value": "T17AB2D895B956C903CBD68272FF1F928837160748F1DA73039E263B76964BC270FBA644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866771, "uuid": "ae6e90b3-8edc-40ff-b429-5d1948ed8c35", "value": "384:5LiRGPdq4r+vBiAfG254juB222222neqdWtpTDP208q11/jrBlujJ8yFx4e:5Gkdq4r+vIAf9eqdWtpXmkFlujJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866771, "uuid": "0a881d65-4ff9-4500-881a-c553f5eab1ef", "value": 25400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866771, "uuid": "ba6f0ea1-5548-408f-a60e-7b9c45302bdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866771, "uuid": "417dcc9a-e874-4553-b56e-4382bc71b428", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81371135-886d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756866434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866434, "uuid": "09144f21-6646-44c8-adeb-3c0e03ba363a", "comment": "Malware payload", "value": "1897040b34e8c8e818e7ab9f43254da2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866434, "uuid": "39f1b333-c05e-44e4-a683-6295760e7015", "comment": "Malware payload", "value": "37c8a675f1d8205cebc28771689f23c707c16f31e2a06c9ce9447306d41271bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866434, "uuid": "b1112339-2b35-43c0-a64c-96c930da0c39", "comment": "Malware payload", "value": "39f3b7d9533486a5c054cf46960d18daaa52f717", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866434, "uuid": "e9c7c74d-60e4-4f20-9434-83fd89fafcfe", "comment": "Malware payload", "value": "77185a221a12fcab70ba3016dda57b672678c72d80327f422c64a948f1e3d96722d6da316dc256fa794fd400e5faee2e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866434, "uuid": "b0dee664-dbe2-4505-9ed6-3e5277c355d5", "value": "T108B53399452AC41CFC8CAEF98D19ED8870DB8121BCB1073523D877A1BB2A7F41B7E456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866434, "uuid": "1d784679-47dc-489c-bf01-e3ba85d6442f", "value": "49152:jVFShTDWXw79KwZ8WxFdP6RgvCXMjDExc+62xjd6p6jI8jijaC1bF:jSbrZvxFdP+gaXSDtQNd6p6dMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866434, "uuid": "4ab3c611-9167-40ae-b834-fa646e32d13c", "value": 2357753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866434, "uuid": "6ff377f7-4aca-4cfa-aa55-a400d36772dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866434, "uuid": "9a40debd-a496-46ba-919e-cbd56b00c842", "value": "ActiveSync.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7467e0be-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929978, "uuid": "227f12e3-7d6c-4e1a-9716-5d3aa03f48cd", "comment": "Malware payload (Mirai)", "value": "bcaae4be4e5012887fca9144bb90c0c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929978, "uuid": "638a3cbe-8a92-4be2-82c3-8369a1c9cb78", "comment": "Malware payload (Mirai)", "value": "38b7a315c14a37df87264e13e248de4f2098cac2c7c9db9818b305330b5825dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929978, "uuid": "e2e42571-424b-4334-8dc0-198c55b60b19", "comment": "Malware payload (Mirai)", "value": "70c3d4f70a3485db1baf6c88d543b1c1eb74326a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929978, "uuid": "3442d562-4c83-4a3d-967b-0c62977cd2a5", "comment": "Malware payload (Mirai)", "value": "e9e05d861105279db65183e14c9675d278885b5088e0f53e62bf690ccd0dee3ed84721d8eb1c832e87749beb855e19d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929978, "uuid": "1a72f6d5-ca7a-40e1-b09c-562d6bed15cb", "value": "T1C0235CC5A447D9FCEC190A352177EF319AF6E93F1098D983C398AD73E942602E5072AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929978, "uuid": "438118ce-86c1-4ccb-b3c5-41fb7d662453", "value": "768:Ii+liNWE5FttdEioOs5BcbV7UzcpAWfd/046SDZk/yI:IiK25FttdEioOszkV7UZWV/046OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929978, "uuid": "6aa5ee8d-4723-4212-92d8-84fd87195b48", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929978, "uuid": "af8b6b23-9125-4a3f-a0b8-d0d0e0fa7450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929978, "uuid": "c9fe1a8d-6794-4d1d-b369-5699191e3070", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5998580-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894010, "uuid": "5102e4d4-7ca4-4a53-9bc9-c6ee97d9860c", "comment": "Malware payload (Mirai)", "value": "d9ec93dc81751e155e00821eccf2b554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894010, "uuid": "f5e0fbad-d4fe-4a95-86a7-211b2965d456", "comment": "Malware payload (Mirai)", "value": "38e47119b088297ba98fe3db4022607ff33af93d40ebc4991de353a424d180cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894010, "uuid": "2293d5ee-25b1-4bb2-9d94-71b20243671b", "comment": "Malware payload (Mirai)", "value": "d7b17611e2fe54f540502497564eff0ce73ad602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894010, "uuid": "784be908-9ffb-4421-a308-f3b22ca934f8", "comment": "Malware payload (Mirai)", "value": "957e8e5f0ded4a6a2c3d8cafb5f14e96a725b2cad0837a461e9a9e95155df05bae438f5f55b05d52a28f32ca9244506c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894010, "uuid": "f971f59e-c05d-4890-b736-d0f6109c3b64", "value": "T13E539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894010, "uuid": "62c79ce0-4e80-4144-bc8c-23b2a679092d", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894010, "uuid": "90d60eb6-c28d-4633-87fe-cc187e04167a", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894010, "uuid": "72e96807-9303-4013-aca1-106297d51c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894010, "uuid": "0c98713d-3ef7-4c62-80cc-3e168c7aed1c", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5190fc5f-88a3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756889547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889547, "uuid": "43bc1d59-640b-4860-953f-642a71e2c5d2", "comment": "Malware payload (Formbook)", "value": "ecee5cac8dbb4b2ff440836979ea5835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889547, "uuid": "736ea517-19f5-493e-b7ac-b6a6442f1ac2", "comment": "Malware payload (Formbook)", "value": "395de71926a9c15057a2767ac6ea27c2829b3b05c2ecfaf325b070b23a12f393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889547, "uuid": "3884cd63-be60-4abd-98fe-aa57572f531e", "comment": "Malware payload (Formbook)", "value": "438318c24937837e403db5399707323288d911b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889547, "uuid": "edf92b83-93d4-4067-abac-b0ef622b2b71", "comment": "Malware payload (Formbook)", "value": "6cc9aabd9bca43b1362bf1adcc69b35b9854220c21b30a123d0c6b5adc2aa6511bafa2d8e1abd176dd63d773d482cfab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889547, "uuid": "552ef737-ecd9-4a60-bddd-59480622d3b7", "value": "T143150278B18E48E7E26A49B44579BC616BB170E3B9C9D6B40B296148CFE7F503F0844F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889547, "uuid": "c908672c-5581-40c2-ba94-c515b3dd7547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889547, "uuid": "4e014bc1-7967-48bc-bb0c-9bc363a873e6", "value": "24576:7LtICqRROmvBMtE+emfLAkdthKyYxc5L:7GCwo21+zdmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756889547, "uuid": "424230c7-b1ce-4a34-9fa6-db6504775fcb", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756889547, "uuid": "d8d71a75-a25b-48b4-8c39-ebb533a76961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889547, "uuid": "de6c333f-4d34-4a55-9680-0e2a0eef6605", "value": "REF930008102929110222_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0faad58-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1756923262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923262, "uuid": "892f240e-76c7-42a6-9908-c94b41b447c7", "comment": "Malware payload (AsyncRAT)", "value": "e1bac1f381bb857a877124ae86281984", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923262, "uuid": "f773e382-2204-4a32-b080-a527fb464722", "comment": "Malware payload (AsyncRAT)", "value": "3b40cbd70c8f42a757ebb650ad908de05dbc647ade92e773cb17e62ea5c0bac1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923262, "uuid": "6ae56ed3-a8a9-4478-9eb0-0691185b480a", "comment": "Malware payload (AsyncRAT)", "value": "36c483cf4e2bee61342b4ebd66dcbe0fe0cc5505", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923262, "uuid": "a99e4447-7796-48ab-9468-0ffcae00b047", "comment": "Malware payload (AsyncRAT)", "value": "ae9ea0dffeddd37b2200c27f03abaa96c782ee1a782d08aa282f36c88cdddababd192c4bd3b336d337e14ff7788474e6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923262, "uuid": "651c500d-0f6e-47f5-8111-661133bf9c16", "value": "T134A48894E5A37E91ADD0CA671739EAFCA93B0572BDCB1A30C3FCD518D07019B4A80D66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923262, "uuid": "209b38d1-6a99-4b4e-9526-5655daa04a08", "value": "6144:OusDDBfyx5+1jdUrSLk/6uv5usDDBfyx5+1jdUrSLk/6uvh:/shyx5L0k/6fshyx5L0k/6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923262, "uuid": "1bbcceda-373f-4df3-89d3-5407cf9d7739", "value": 465218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923262, "uuid": "ad4c7417-68cd-4b65-a365-4de539dee16a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923262, "uuid": "36c864bd-e90c-43b9-8762-88c242a9b981", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b12d795-88ba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756899415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899415, "uuid": "06485923-3261-4318-badb-4ca0201d607e", "comment": "Malware payload", "value": "ba7133764ae07c2336ca1829ca2b43dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899415, "uuid": "525ead48-f65c-4b96-96b0-0df36177fc5e", "comment": "Malware payload", "value": "3be1d802057f32e2c39bcb23ee8255109f600ccfeafe4024f8e0eb596d1a3121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899415, "uuid": "8b9014c5-c98f-4dea-9615-fb1e3b85fa69", "comment": "Malware payload", "value": "1872ae34cf2a81477c2862a6e6c06ee66bc96e87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899415, "uuid": "3d65f288-473c-4b32-93d9-4a71a4d0aa7a", "comment": "Malware payload", "value": "258f6b774ca054adcd86256b7f0b06e6a85a89cb756f1917b242228d21073fd7a47de4e799363b671116a48aba0ab424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899415, "uuid": "392303a0-d6f1-47bf-97e3-3d19846207e0", "value": "T10047120987AACBD7D443F0F8EC017783E4D4F7988D5BA35CDE4D9829684BB98409BD68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899415, "uuid": "3631a260-2910-486b-8e12-cb38cf2af4f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899415, "uuid": "94e413c7-5805-4665-8334-66ad306ed317", "value": "196608:gg3xNvoc17HxhsfwYuEgF4mW+nWGFDLSxAUDDJtmLGZqNH1mh/GnIewYF58Qwj:3T1jxKfw+gFx3nd9LIAUvmqZ4VdIAFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899415, "uuid": "4c5bf690-9503-483c-8b09-d58961bdfb6e", "value": 25119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899415, "uuid": "3dd65fdd-64d9-4b89-9fa4-e460325ea3f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899415, "uuid": "fe27e33c-8976-4eeb-8cf4-ba2a5c0ff1d7", "value": "3be1d802057f32e2c39bcb23ee8255109f600ccfeafe4024f8e0eb596d1a3121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fdb98c-88a0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756888348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888348, "uuid": "66584bc7-59f7-4c6f-9e8a-ad10d536d397", "comment": "Malware payload (Mirai)", "value": "fd8cfa668038b4447310aadb4f441db4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888348, "uuid": "3d78de75-75b1-4a8c-a33e-1a4f76e0fcde", "comment": "Malware payload (Mirai)", "value": "3beb7fea1cd72ce56b536545ddc338b9fa51905eae0da92a41602ca7ef5b57bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888348, "uuid": "26fd70b8-0ed0-4e86-ae0d-77382fb4e7fa", "comment": "Malware payload (Mirai)", "value": "09b0e3960e115c4e12d9dfc1951d91f6f3b541b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888348, "uuid": "68c19450-ff7e-41ba-a577-e6fbf904854f", "comment": "Malware payload (Mirai)", "value": "676dfee1ca76cb1b2befa17b115e1d4c0e138ada0d9d82ec4226369bc5d8300d085014ad4cb804b782e108d288e789a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888348, "uuid": "8f1901e0-52af-4532-92a7-11cc57439d03", "value": "T172B3F85777109F62C26DC23009B3C7566BEA26D22AE24445B31CDA1C2E3535DB92FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888348, "uuid": "fe910815-e6ce-409b-ad69-22c5a9af30b4", "value": "1536:Tc+bSz9OT64I1vvbc86a9l1QessaVfLBzS/rb5SFeGLLnie7BLgOdse4W5DvrY:Trsp1caH1Qessax8lSFNrL7BLgOdtNjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756888348, "uuid": "fc7189f5-f3ec-4e6c-98dc-4843302fa2c9", "value": 110620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756888348, "uuid": "ef072adf-9e93-447d-9af8-d2baebd10b28", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888348, "uuid": "fcc9fc85-2170-48df-8822-6353f11e18b1", "value": "kitty.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b632425-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866827, "uuid": "5781e147-b170-46dd-8b58-3dd83ab0323b", "comment": "Malware payload (Mirai)", "value": "30eee5d49a07f23e4e0ecf219b160748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866827, "uuid": "441c8c9b-d063-4e59-bee5-7cf6ba6eb59c", "comment": "Malware payload (Mirai)", "value": "3d439688c01b658a19180d72b1df7d83bdbbb3300056bfada48bb454fb894a51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866827, "uuid": "738a4cdf-0916-4870-a2e6-5aaa1e71c27f", "comment": "Malware payload (Mirai)", "value": "54e064f1036d3577506988c7c7542fe9024ec29b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866827, "uuid": "4b31a631-51d3-4c52-85c0-06bc019fba68", "comment": "Malware payload (Mirai)", "value": "202fdd6bd8bbed641a9eed4910c307cc7d19d8538189e85fa1368ff8edce0676d738eae321686d8a85360d9a7f4823c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866827, "uuid": "d9d61c15-1930-4d17-9e05-98e86a37b7b3", "value": "T19B73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866827, "uuid": "4b78d46f-7d43-45db-9a70-c432aa0f33f0", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStT:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866827, "uuid": "632711b3-8ace-411e-b036-9361427edd97", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866827, "uuid": "65fde925-43c0-485b-a84f-2988a023a5bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866827, "uuid": "49499e5c-a95b-437c-bf02-3371053a13e8", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59960527-88d2-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1756909747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756909747, "uuid": "0aa22e43-f2ea-46e5-93b6-deecd12404bc", "comment": "Malware payload (MassLogger)", "value": "57c0fd6dc79db3bedb2238eaa22a9e8e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756909747, "uuid": "f6ab8017-5b0f-4ba8-be0d-bf9436f488db", "comment": "Malware payload (MassLogger)", "value": "3e0f36140d18878db89c424c6c0293710523c9973bcf5b64f81bc26a2e8de8d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756909747, "uuid": "1bd087aa-160f-4e4a-b06b-b474ac13e93e", "comment": "Malware payload (MassLogger)", "value": "7a8683302818236d34abd6682297a7658d42f668", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756909747, "uuid": "4c98df6f-c19b-4329-ba35-78df4f6aa5c5", "comment": "Malware payload (MassLogger)", "value": "f916bf02c738b30c3b4b2b645cd1137b17e3f9b536af9b4e54d10ada5a973ddaf7be3dae0d82b623c753557d0961725d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756909747, "uuid": "38a4ae14-0487-4ab0-8fea-0141122139f5", "value": "T1F836333301C96322BECF30253CB6BBE4B31C861F49B9CFADA61664EA2115715BA57C5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756909747, "uuid": "057dcde5-c136-4a47-bf9a-d0821879f345", "value": "98304:GMJaD8gExswMg4DR6AJx3AsdEK5byE2F/wmC0KpZrPOm2iZcJRnZW3kd:G7DxwMjDIAPAuZR2ymCnPGOmF6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756909747, "uuid": "6a248318-0ef7-4ab4-97d1-b81b746a14f3", "value": 5186019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756909747, "uuid": "5d97da31-3413-4dde-b364-1a2af57df6f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756909747, "uuid": "673af763-48d5-47f1-b246-5164a09fd800", "value": "image_00102pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bd9fd5-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876023, "uuid": "f7ce5a76-163c-46bd-b5b6-672d55577948", "comment": "Malware payload", "value": "b6fee0b02f10dd3db56e8aabb0c7a338", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876023, "uuid": "6acb8db4-b6c5-4e0f-abf1-5b79c587c9e3", "comment": "Malware payload", "value": "3fd2ec96d43db3f83a82f276bac0e4314df494bbb038548f1ca0e4ec5c260d13", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876023, "uuid": "828d572e-7c1e-47e8-83b6-ce25638d8717", "comment": "Malware payload", "value": "8332b9ded45e7c55cdbbd6e87f0f04a44162dc07", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876023, "uuid": "8a8df8d1-271a-4fa7-8295-e18afa5a8fb1", "comment": "Malware payload", "value": "bbc276e8d856a9f30cb2bf86ff67e728b793ecc44a55c75a4a30d23c93826156aa6821eaf102f4098da4779e530154e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876023, "uuid": "c9a75403-80a2-4558-9d2e-41a3241435b6", "value": "T1E9B2B615BB3A5DB4BFD7F8A0B20E142478C4614A4F8B7808B41D6CBD562EEBC675902F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876023, "uuid": "43717656-2c65-4655-b4f4-f688fdc2c8c4", "value": "768:xzB9x5T5ua/5HaM5G5r0zI3NAuSuBB2TJ77STJD8m9SPVfT31X13g5S47mMqu:ZB9x5oa/laME10zI3NATIB2TJ77STJDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876023, "uuid": "92ea25b7-927b-4d8a-bea1-0daa116d7b8f", "value": 25141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876023, "uuid": "cb199c70-94de-4034-8972-695e530e342d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876023, "uuid": "bddf0165-e1a8-4ae2-a234-8b068c497b32", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844b9703-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872882, "uuid": "0739ec49-7780-415a-b000-c56eac8d3d32", "comment": "Malware payload (Mirai)", "value": "d016537d635e14ccb5d4ece91e54addf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872882, "uuid": "7ef625a3-77d4-44a3-a1ab-3e9cc4b2c818", "comment": "Malware payload (Mirai)", "value": "3fedbb85ead1f892dff27348b896ee72a565900039067a9d33f980da7d553a56", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872882, "uuid": "9f143b10-5524-4a83-b259-7bc6aa9e8437", "comment": "Malware payload (Mirai)", "value": "35851b0409d3d2561c55ea6cb0b3539a2943b669", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872882, "uuid": "2964371d-435a-432e-9a98-c0155853a3c5", "comment": "Malware payload (Mirai)", "value": "ca0b8e21c31a99cf44ac5751a8168e92f129db00d0585ee199fe362260b605dd8fc4175c966baf91b48b77ef85471bdc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872882, "uuid": "7982f535-5529-4097-8d4c-72772ad024d9", "value": "T16EE04FE500548EA4BCC069CF34A58A137423D25E18C56F96EFDC21F6449CC04B852B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872882, "uuid": "c8cda846-f65a-4f3d-9422-3768c1849cd1", "value": "3:QnQNFn8Na2ZQII5eEdcgbSoOjVxi8LUTidaSSE8qa4aYeVBwOnQNFn8Na2ZQIIQ9:lswzI9Edcg2EOtFzswzIddcg2xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872882, "uuid": "7c2edca2-29f5-416f-bd16-9d53cfdb5b9c", "value": 327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872882, "uuid": "95a9399a-74f2-45a2-9d7c-8bb8ab4673e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872882, "uuid": "67b51e5a-72a3-4d74-aa32-3455fef102ed", "value": "goahead.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a656b2-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913312, "uuid": "afe80e7e-da27-458d-b58a-919163fe4c6d", "comment": "Malware payload (Mirai)", "value": "cd64858440dbad5a278a2008ea26566c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913312, "uuid": "5f9f79c5-4614-41cf-8a68-10eac68ef5f6", "comment": "Malware payload (Mirai)", "value": "40153e866564de3c77352832903d045a30f6845c6bcb7b11beef6e0f977da78a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913312, "uuid": "e48c27f1-a357-4385-99c7-5e9a031e9033", "comment": "Malware payload (Mirai)", "value": "21e87582df6f9cd6b6a161c5804561146c163e20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913312, "uuid": "7c14bf3c-e62a-4297-9c93-8bbf84c689fa", "comment": "Malware payload (Mirai)", "value": "701f0909324ef24d1410295787daf56db62910a463d9feb00cbebf6a0f5f93024a3d11fed2ceaed455065e01bdb7369b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913312, "uuid": "44f8e57a-c74a-44d3-912a-c5ba93f16c7d", "value": "T1C063951E7E259FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913312, "uuid": "29dcfc37-097d-4852-8477-39c6d7cc8d29", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAc:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzvL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913312, "uuid": "3d5ed215-cd6c-4703-865b-5c7bee6c8e69", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913312, "uuid": "dbd224df-b55f-44b9-8930-84bd11d40eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913312, "uuid": "43f3a018-fd91-46b1-a538-b035c31f9f9f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21735b7d-88ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1756894191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894191, "uuid": "e6361624-93c8-4f13-9409-484c649ab3ae", "comment": "Malware payload (PhantomStealer)", "value": "f652e50fb827eeef0dc21f53ec6ce6ab", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894191, "uuid": "0a3ca592-d7b3-47f2-8c4f-0a27c53241a8", "comment": "Malware payload (PhantomStealer)", "value": "401acdc9361c2358ab84e5860adce7aa24422fdc584e9109d7c8feec0c45628b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894191, "uuid": "87a43a27-a5fc-4439-850c-ada2296188c7", "comment": "Malware payload (PhantomStealer)", "value": "5139777eb08ef48dfa7f590f83a1bed137e6405c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894191, "uuid": "1578cb0e-31e5-4e79-8146-87fa9e80d543", "comment": "Malware payload (PhantomStealer)", "value": "5f47dcd7d1354c2cb129c3b2080e11bec55ecb016cbea35db9b93d4ec754d0c4c24e6043837015fb172ffc41d08538c0", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894191, "uuid": "f8e95951-d9fe-4814-a4e7-26f6a72aa22d", "value": "T1F5A2E164CA1B755E90AA5E2C3841B9819CDFF1FF0287D4820FCF94858D9D0AA7CA2DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894191, "uuid": "4f1cb9a2-9ca0-4cbb-ac21-d09312e50841", "value": "384:cNqY9CJ9cDC34EPaafU9Ujkb4SS5QQc8jn3KyzA1I2IKC4/7866U6VOnW0AwP5y7:kqiDC3eas6QbVSQJ66CA1I2IKCM78U67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894191, "uuid": "cdf92190-abf3-49f9-afd8-6d4e23d53839", "value": 22938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894191, "uuid": "5a2af4a7-0dd5-4814-a1d0-c55111d8fbbc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894191, "uuid": "9f508921-3197-49f5-8e4b-72aca0057989", "value": "ENQ-PO#40KDB900-Materials-Spec-Details.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f457a619-8862-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756861903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756861903, "uuid": "f7d0a926-2f50-4add-9523-35d0a519dbb9", "comment": "Malware payload (Mirai)", "value": "77186d5da543f5be6d34a7b7a5c7581f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756861903, "uuid": "0133ccb4-c15a-44a3-a51b-3cffa7a5438f", "comment": "Malware payload (Mirai)", "value": "40b70454a2e34804db7ee8e6eed43bcf55f1bab7b6473bce7e1b0e6ae3a5aab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756861903, "uuid": "c8a932d8-fef2-45af-a12a-8fbcfd02e398", "comment": "Malware payload (Mirai)", "value": "cbd6883c50c53ff7cccfdc11a08baa26294ea4e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756861903, "uuid": "bd8579ed-46be-47eb-be64-c5b5660a2cf7", "comment": "Malware payload (Mirai)", "value": "49143a4ff6c2f5c04e590e74037a734489703bb0e54517ff98a19d7e3e0a85f1f66cd191ffeab328b16b9caafc929bd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756861903, "uuid": "1c177df7-c697-42c2-8b24-a15165131d82", "value": "T11CE3F749ED42AF00D5D636FAFE4E428973535B6CE3FE71119E245B2127CAA2B0F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756861903, "uuid": "51773ad3-602a-4089-b127-ec4ba8e505ca", "value": "3072:3jHckQ1DnsIYjwsbvb/i3oxnRNDehEDaIuq21HoYD8SZkRAzuuAQ4IT0rn1P:3jHckQ1DnsIYskvbLdRxsEDaIuj1HoYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756861903, "uuid": "fe1d7daf-e07a-4d78-aa5a-aa575a097edd", "value": 149412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756861903, "uuid": "9b282da2-8058-41d3-8e9f-962e72ee68cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756861903, "uuid": "556e8632-1b81-4b91-917a-6c7ba078a8ff", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97afa266-88fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1756928749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756928749, "uuid": "b6d10d12-e1fc-40a9-ac71-c7faff97b0b0", "comment": "Malware payload (a310Logger)", "value": "25a9197c370a42ab03e3d26c515f1b5d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756928749, "uuid": "ef978132-8f7d-40f8-ac5b-74892b300cda", "comment": "Malware payload (a310Logger)", "value": "413f7d00e03f5dd9362c7d2c8e5ee71de5379343db934bc87a4dd15e251b488c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756928749, "uuid": "d1202fd7-4160-457d-9b97-a361ce4d9f26", "comment": "Malware payload (a310Logger)", "value": "437d3bb69faa5f84e42e39a0fb5629edd6123556", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756928749, "uuid": "0f80bda3-dece-4503-9d68-85cfa67130ff", "comment": "Malware payload (a310Logger)", "value": "87df95ae4fae0cb766f105e29217a11900246116d2b137385081227bfb37ce1c312cbfd912624952e3ef15ec06aeff86", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756928749, "uuid": "6c3c8303-a072-4bcc-a023-122dbf2307cf", "value": "T1BF1501D1B210C699FDB613706C22CAB51A672CFEE5B1D20925FDBD633AF7362000965B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756928749, "uuid": "765926fa-3fba-4a51-9936-0625e3a1a91a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756928749, "uuid": "3c4cee8d-10ec-4dc8-8499-a9fefa56bf7b", "value": "12288:7L00OWcTgtc1HBFEuMANxF/mkffxmV8S4nORYQxQn7TnY3JcPT1nqr80mW0:70dHF/mOmVUnOM7U3yxU804", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756928749, "uuid": "bd14d1a1-7d0f-4a8a-b6ac-3b6d5b50b4d4", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756928749, "uuid": "ad4ddbec-3694-4975-926a-4d3f74a5c497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756928749, "uuid": "4b991cf5-d8b7-4a57-b8ac-d64cfb7f6557", "value": "DOKJH0987654567890000.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5df40c5-886a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756865261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865261, "uuid": "713dae74-cb87-4eed-8688-701c57251d06", "comment": "Malware payload (Mirai)", "value": "0585b12d5d373f4bc69bf199021938ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865261, "uuid": "fcf9f2e8-c843-4e7a-b744-f2c17f0206fe", "comment": "Malware payload (Mirai)", "value": "42fbc617be354079673bd2fe0ddca9980e834e631681cf5460cd87eb39e2391e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865261, "uuid": "a9c2a12e-ece7-4af1-b3c9-7ad5e12980f6", "comment": "Malware payload (Mirai)", "value": "cae67040239a06adf9531ab3c50622da0545da7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865261, "uuid": "25638735-821b-42ed-8d08-8b7414e09e4e", "comment": "Malware payload (Mirai)", "value": "04e21f13ee8a158e5e17edc899c866451f471d5a6608be0363295241087531c8ae4bd9d4444413b6ebc0dd6683cefbe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865261, "uuid": "13a659b4-4c8f-47e0-ba71-a4ae859bf40b", "value": "T18324955E6A328F7DF368873447B34A30975D22DA27E1DA84D2ACC1041F6435E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865261, "uuid": "2a303a0b-dde4-430c-a151-afeb5a2d1cab", "value": "3072:KHxohcRzP8Si0mFt26y2OTwSuJeEI4NzkXpcEa/C:wPRzP8SVmF1RU7oIsgpcP/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756865261, "uuid": "d9e9eadf-f2ec-4b84-9912-3597d2edf306", "value": 209688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756865261, "uuid": "72ad7b15-9ab4-452f-95f8-50ff4f4fd6b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865261, "uuid": "5ab23943-6ceb-4d7b-b3c7-6a2f1ee43604", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2d3074-88ae-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756894184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894184, "uuid": "ebbac333-40a1-4530-a8bf-7c706414ad9c", "comment": "Malware payload", "value": "136fcc0c94b2b01ee32c70af4da62e76", "object_relation": "md5", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894184, "uuid": "3faffb42-456e-4915-b130-67a9841a5f13", "comment": "Malware payload", "value": "4357bb80bc59ea38eeb298867b12a75c45ad6f67d5b3ce3373748034a5f7637d", "object_relation": "sha256", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894184, "uuid": "d337e1b0-ae84-42b5-ae3c-4889bf90ddb0", "comment": "Malware payload", "value": "674d144010a73adf59c8bec022c24bcfd1058b35", "object_relation": "sha1", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894184, "uuid": "71f9e206-a52c-4b2e-8737-86ae253a58b8", "comment": "Malware payload", "value": "669c22b81828226358999888822ec2e76d35120bd81d2b57c568f4e27447b5219a8bf4f2f678c193a9fdf88b142589b1", "object_relation": "sha3-384", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894184, "uuid": "b5ed66c4-6868-422e-817e-f6eaeb6727a9", "value": "T1F433F198BC13CE9A059C0875E2C728C9BF15488203F8AE94ED0B473A5D236CFB1635D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894184, "uuid": "e69914db-7998-4ba9-8605-40580761f29c", "value": "1536:xgee5f6E2tf1xlV7b8Rb2OjXSbyKmAcATfLYz:le5Z2tfLXQMsXS6m/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894184, "uuid": "62a476ac-a995-4ef6-8abb-29394b92ae0a", "value": 54478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894184, "uuid": "9177bcc6-60d2-4761-9b54-241826c45ebe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894184, "uuid": "7797068d-f610-4fec-93c5-27c73e968e9d", "value": "RFQ PO-ASM202503001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095b565a-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872676, "uuid": "c6a8165a-9220-4f56-8717-37f8f8603f48", "comment": "Malware payload (Mirai)", "value": "93e968c4b1a47d7cbe5ceb4abf90daaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872676, "uuid": "401d18ba-86d1-4c3a-acf6-d1b9a6bc4385", "comment": "Malware payload (Mirai)", "value": "4446e14f0b0ebf9776d5ff17244bff246c4db3e24ba21f95b67cc8f0bae98b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872676, "uuid": "9acde8d2-993e-45ca-9386-b323590baef9", "comment": "Malware payload (Mirai)", "value": "85ddf5b828dfd0bb5817404d8186b71d12ed600d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872676, "uuid": "261e73ab-62c0-478b-b3d3-844f9fc04395", "comment": "Malware payload (Mirai)", "value": "e2b736f9f4f16d17ae740e063d5619cdd9f1cb8d5892af89c08c280650dcb9e19ef51a79372739a8447b807f7e5ccf46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872676, "uuid": "767d075f-8f7f-4961-b03d-825115475974", "value": "T1A521749AA7D7AD1ACC484273DDAB6710A322AE84869EB913E31116150C7E32A1F22199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872676, "uuid": "82b98f70-769a-43b9-9e45-a5199242fa02", "value": "24:JiAtVsgP9qD0at6EoNGZrUlFSy43zLCkIdsx2HwQIf6pNfe:JPtVFFqDPtLrkFSy43zLiIf6pNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872676, "uuid": "30515b5e-ee96-48c5-bae4-7b0229b903e8", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872676, "uuid": "97df630b-8169-4003-8216-d21cbfa8fee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872676, "uuid": "284aef66-0260-406f-876c-4b0dc96299dd", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cc61a2-8871-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756868085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868085, "uuid": "4b65f726-b2fb-41ef-b88f-146239e3f665", "comment": "Malware payload (Mirai)", "value": "94a0c128c3a8ea99414bc95ab0d72ec6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868085, "uuid": "fcd717c2-f9ad-4844-af04-a5de2f1ac145", "comment": "Malware payload (Mirai)", "value": "445cbb43cc820924df07f69d52d1c6caa2afd185fd852d724c5c176fbf8df971", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868085, "uuid": "dabc2e3c-f913-4e26-a2f2-0ea863c3bae3", "comment": "Malware payload (Mirai)", "value": "d2bcaab1e527866c10bb6fc2d6ba26cd605e66fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868085, "uuid": "e13d8d0e-7e57-4026-9c75-f42a2471d620", "comment": "Malware payload (Mirai)", "value": "4b223f08e3984204a10c1bf1b016b1ec5cf5aba8517b3c68800ea8c8f298e8e980e5050c949ade68435a07981e666b12", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868085, "uuid": "eaa50cfa-88ec-4807-a21c-69b727b2cc4b", "value": "T1FC5199EF238286335CB9EED775A88414724551AFE8CE6F7554ECBCFE404DE096840A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868085, "uuid": "237ebadc-6400-42f0-8c17-a301d10cff63", "value": "48:Y1aZ1/31w91vf1xL1dL1/E/11uR1NvL1SDJ13f1rD1011d+dBgJs1vjk:YitQt7zo+vLah5cb6BgJsJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868085, "uuid": "ecc7c6da-2131-4f52-ac86-9cc4e0ada49f", "value": 3047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868085, "uuid": "9ae5c126-9ea5-4d8d-8a90-29512362152b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868085, "uuid": "ba5caf69-22db-46bd-ab1f-faafa1b64a6e", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5791a5-88b1-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756895469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895469, "uuid": "774eae61-4327-435f-8ad1-be437ca81fbc", "comment": "Malware payload (GuLoader)", "value": "caef79c35b0c586ecc28a8e6a4d9fe94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895469, "uuid": "73eadab3-3917-4269-9d3e-72cd582d495b", "comment": "Malware payload (GuLoader)", "value": "4504f2ee6ddd3759336ad84917b87ce3bd94efa5ee24c080898a6d0a41b31405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895469, "uuid": "f6db96c7-5387-4803-94ba-49f52c9ca549", "comment": "Malware payload (GuLoader)", "value": "191ae1ca3486c9e503f60cc22acbd150505444b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895469, "uuid": "13952158-628e-4cc1-976f-9351a2e445be", "comment": "Malware payload (GuLoader)", "value": "d4e37266c9b8e170d28b9bea017a22d9591da580a58369aeccf59e6a8c6c02a6f8cfa581572cc8a7d8514f6153a9707a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895469, "uuid": "b64453fa-4f28-4405-8d08-fecbf93efc78", "value": "T1F5152274B28BD7C6C98AB6343E26DA7A05E59D34DA2CBE2377447ECE703356A1C0D160", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895469, "uuid": "b3126d52-34c8-493e-b58c-b5eea57e8cf5", "value": "84062c623770f0d888e4ca58451aa7ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895469, "uuid": "c91319b3-01a0-4f3d-a307-86c3980073a8", "value": "24576:bFZ1cBrqY5c5Y4rQHsJ5BVWKCWi1ODLrffj:b314qY5c5trQOxWjWfrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756895469, "uuid": "6c482aa8-d0b4-4141-ade0-70cb4eff74f6", "value": 925553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756895469, "uuid": "cae583db-3979-429d-ad10-e1f60f434371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895469, "uuid": "b1ec2e84-6177-4b8d-813f-14d7dde9dc28", "value": "4504f2ee6ddd3759336ad84917b87ce3bd94efa5ee24c080898a6d0a41b31405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770b3e19-8881-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1756875007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756875007, "uuid": "6727d3fa-6ad5-4e01-8522-a6e2a23e7206", "comment": "Malware payload (AsyncRAT)", "value": "5dac77a4c6854cf84b6d7a6c3a490bef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756875007, "uuid": "0174cdc9-93cb-4b7e-98bb-f58479bc8aeb", "comment": "Malware payload (AsyncRAT)", "value": "459e3408113537088a5825a91741e4a1de346bdef172710437725554ee90b04c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756875007, "uuid": "9e681865-6941-4ab4-ae14-8076d196dfd7", "comment": "Malware payload (AsyncRAT)", "value": "e7a94b73e4ec75357b3634636c2f14c6f1c2704b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756875007, "uuid": "0dd27cfb-8758-4d66-ae88-986999ee7f5b", "comment": "Malware payload (AsyncRAT)", "value": "88177a7baa6c321487c0cff93593f34e3f69410aef7729572ec199c7464cde662e21f165e69aedda5100f65c3e57be2e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756875007, "uuid": "67ae2d89-a0dc-45ec-ace0-64a289161677", "value": "T1B0C4ADAC3251B59FC853C9729DA4DD70A6246CBA930BC203A0E71DAFB90D997DF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756875007, "uuid": "eb97d337-63ad-465a-8649-828b47499b25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756875007, "uuid": "b71d118a-d76a-49a4-bc1e-77ac01024146", "value": "12288:lbK0OWUR++1olVOGGZ9DhnsRi5Du0IDyabAF3DEQRpRnYal7N2J3Lf85:YzqrEDhns4Du0I+kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756875007, "uuid": "6bd2334d-7c5c-46b8-adb0-37ce443a7bff", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756875007, "uuid": "143797fb-73a8-4cef-a580-30ff30dfc9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756875007, "uuid": "c7db5efd-7fc8-45a9-b7c3-a1c9158cc6a1", "value": "E8npqLxtYJ9Q0q2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd922033-88b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756898855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898855, "uuid": "43ac821f-891b-4335-936c-f99f0a980c54", "comment": "Malware payload", "value": "4d62be2a2b3e81ebcf582b72b3232320", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12652443", "colour": "#9DA6F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898855, "uuid": "72aad7d4-9e60-4ebe-96a5-35b677ba9e4c", "comment": "Malware payload", "value": "45d2b5d96fd6c846cba01eeca8bb65df5b5a2dbd420635edd6de22d93c75f8af", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12652443", "colour": "#9DA6F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898855, "uuid": "a15d0b92-a524-4a0b-9322-dc29c87c1411", "comment": "Malware payload", "value": "f4592b84d17668d9b3f6c313d1ec1c28c2be9675", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12652443", "colour": "#9DA6F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898855, "uuid": "6b125056-b7ce-4659-b82e-1101fe9469f4", "comment": "Malware payload", "value": "088b3d25b512170dbfa562653ffef5da3eae9157f9aa5eb0b8ccb24d1547eb1c706fe1af437cd4f1d502eaf9fbf59508", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12652443", "colour": "#9DA6F7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898855, "uuid": "ba23728e-b028-43fb-9dc0-1b1e8f7fdf5d", "value": "T1FD33E9562D2A3C199387F9343A7286A3A2CE8D88AEC25DDD8567184A43E0C331553FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898855, "uuid": "fd128cef-3fd8-46eb-bc7c-4fbab8e0bf27", "value": "192:QosoWdbV5YOn2X+a3faOHtfUrmj/WpUoL5L+0/Av62q/3x/SosaYGUB:XsVz52X+avaOHtf0mjulL+SR2q/3xkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756898855, "uuid": "3e8602aa-44b9-4830-8c02-79e7e3b196ae", "value": 50686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756898855, "uuid": "61ade214-a61a-4aa7-a9c1-02ee84af3a50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898855, "uuid": "0fe73be4-6ef2-4219-966c-236eeebe2973", "value": "hello.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7f9d35-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872686, "uuid": "aec34ca9-7853-47c2-8a23-e11a6bb604b5", "comment": "Malware payload (Mirai)", "value": "b948e568e20d3732c1ccc04c0891f9d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872686, "uuid": "a992a813-648f-4ae8-9714-103d1de73ce6", "comment": "Malware payload (Mirai)", "value": "460ff6348db104df522f17d6b45cb49f4ca115ff64762e2d27d054468bf704ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872686, "uuid": "e97018f5-29af-4524-a26b-9ff56af31acf", "comment": "Malware payload (Mirai)", "value": "5371e4a3f3d5b9f6f7c062276b5229695236fc79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872686, "uuid": "e78a5ab2-7203-4028-9b9f-75641761348d", "comment": "Malware payload (Mirai)", "value": "1e33b69e6956c9f5e84f1688f2a2f86013945e74fc3222857785e2cee26fc7f8742ab9e71d63560c70e18c4679e805ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872686, "uuid": "2d5ed1d7-8590-4aec-a1a9-a1cf96d9edfe", "value": "T173210EA2A2D8EC32DB2251FB9247AF561761CD91399EFF1BDE814812EE3D1D0C032235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872686, "uuid": "ad5626a3-04f9-4fe9-80b0-0fee2962f740", "value": "24:Flb4MWFHxgxk2ZO4l2ZW8ANwvMMichGu92/4u0wruQHgeNfvE:fb4h5wOewW8ANwkMichh2/4l8HHgeNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872686, "uuid": "186a2dfe-b3ed-4f0b-bc8a-a2cda0a95aa6", "value": 1172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872686, "uuid": "837a4091-3a90-4224-8541-8c1b780f814e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872686, "uuid": "c0cb70b4-d924-47eb-baf0-292e842fd069", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0998916-88f0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756922778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922778, "uuid": "e4caa9b2-2673-4167-96a2-d8ee2f32854f", "comment": "Malware payload", "value": "a79952a950d1e451f0c54c5ba4fc5013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922778, "uuid": "3e4c7e81-7011-42f6-a1a6-ad3bf84a2dd5", "comment": "Malware payload", "value": "466f9e244b4da580581cc837fbb9f75513386227839932ed8f331c8c9979f8e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922778, "uuid": "f01d7e4b-f023-48e2-8ce5-4db0b6d55ffc", "comment": "Malware payload", "value": "2ccc051e34d42dc0190d79919d3995faca965d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922778, "uuid": "48c84929-c894-4f66-8ecb-1cfe54234187", "comment": "Malware payload", "value": "e2431cffc1f99e36a0df9a524ee81c7becceb7681b6ca4422c08a3adbe6e41e81d4b851d6b247f372f824c11862ae467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922778, "uuid": "890839b1-8b7f-4c2b-9c26-545a4cd43615", "value": "T139D3C56837E5205EE37399394FD5ACBDDB22B2670207B75B702312568909AC9CF613F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922778, "uuid": "9732e834-3c69-4c3b-badd-3760b994aeff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922778, "uuid": "bbbee1f8-2bd9-4139-a3e3-04ec2af9fca1", "value": "3072:/H4EHqynjKPZ9usb2qCgxLXvmZzPmAwCR2N:Iysb2gxLXvmZzeAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756922778, "uuid": "45df65b3-7136-47be-b22b-ea2da99b3d2a", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756922778, "uuid": "761d4568-f6f7-4138-bba9-2500792192ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922778, "uuid": "9fb6e239-2841-48f1-87b7-a588fd4f2e6d", "value": "a79952a950d1e451f0c54c5ba4fc5013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04f6f7c-88ce-11f0-91c6-42010a9c0006", "comment": "Malware payload (Xorbot)", "timestamp": 1756908228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756908228, "uuid": "edc86538-6903-4ac1-a683-6e558a26714c", "comment": "Malware payload (Xorbot)", "value": "8f8cf8278f00830622d7d54d21aa9897", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756908228, "uuid": "6f6b8d02-340a-40b6-9d23-cd1e038dd8ba", "comment": "Malware payload (Xorbot)", "value": "46ec4a527c7d5af8e03783c60de49a97d2dfe2d69a6fde11e2f3b9d08b32fa88", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756908228, "uuid": "e8febb22-e8e5-4ff3-aa8d-aae9ac387cca", "comment": "Malware payload (Xorbot)", "value": "ec73be51004eff293292447067d3a33ca2552935", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756908228, "uuid": "ac2eaf6a-2c5b-4936-ab6b-c7b6622fb380", "comment": "Malware payload (Xorbot)", "value": "fc81b03209eb585a746fb76d9d762218d38e8164af2519bcacc4e8ceb27bd6e758c5b851bd79124a38b37c17bb418e45", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756908228, "uuid": "50b20515-a8ed-4ac9-b94f-59830f7b4557", "value": "T177220FC8A2D123395C5EDE1574B11340F2B851C3B8A3AB30E9DB2CDA98CBF957652F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756908228, "uuid": "8d7c4de5-7e6e-4877-90a0-c9a963a8fcdd", "value": "96:r3H5EHH0Pr0S8cnE1i9BGaG2G/G5MG2GvIsM/0YqMNVbFauDcu/43H5QJHH0PrC8:OV+NtMacfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756908228, "uuid": "20856490-01a5-44b6-bfb1-11be3ced4021", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756908228, "uuid": "e0c9f53e-482a-4668-9738-47446416dca6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756908228, "uuid": "4c959b2d-3ebe-44ee-b9da-81ccfc3a48b3", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446206e4-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866762, "uuid": "c58409e7-bef1-4cb9-b894-7b3c970f199a", "comment": "Malware payload (Mirai)", "value": "19345b74bd7248cea43a6c9a356f9ab0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866762, "uuid": "09467485-2fa7-43aa-993e-ed3895bad848", "comment": "Malware payload (Mirai)", "value": "46f5aac919773e364add16dd2034a332c6eadf8ca0e78086ff69870a710b9f36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866762, "uuid": "7c2f0089-ea78-449c-b1e9-daa713456134", "comment": "Malware payload (Mirai)", "value": "d46db7abbd3013039bbc2f46db754b858f30ebad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866762, "uuid": "05a8ec63-e801-4bb7-8ce9-982b75bfaefb", "comment": "Malware payload (Mirai)", "value": "d50d0d8a2026600578f385895c70698b2b9175f8497a280e468decd273549fcd03f7f7166c94cf9259ca4bab38ced37a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866762, "uuid": "29b677a8-cf90-4a1e-9733-3416f689db92", "value": "T14A03F65AB9919B12C6D55279FF0E118D33170B6CE3EEB3129E246B34978B52B0F3E805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866762, "uuid": "efe946df-d5d0-449a-8a98-e18217e09998", "value": "768:Zpn8ojPgfgIA7T86WtA2cCUKfWmG1jgMAeUiyWAFJWlaKwYV8:Zpnx7gfH/CCj3HMUiNALWla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866762, "uuid": "aeef32c3-e858-49aa-8658-ef0d69571f62", "value": 38004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866762, "uuid": "f5e415f5-7cb0-4a40-a8ba-2ea14de3392e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866762, "uuid": "a95e7c7b-d8d1-4497-8329-2c0711910703", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862a5f5c-88ef-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1756922277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922277, "uuid": "f1d6ac1e-4b43-4025-a93b-76e6416cc7b1", "comment": "Malware payload (CoinMiner)", "value": "8c21082da295c0e5d49f7bc0ed86f4c4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922277, "uuid": "d4a034bd-e078-4155-bf20-0e87d5cac907", "comment": "Malware payload (CoinMiner)", "value": "46fd29ece195bbb304cfb6276e717f06d9717a5bed9056368e4f9f06ead29c86", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922277, "uuid": "02d20fee-1a8f-4abc-aa2c-92a371e87ec3", "comment": "Malware payload (CoinMiner)", "value": "135382cec70cc4682530b98eb4a78b0a337b8a82", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922277, "uuid": "dfb26af4-5326-4088-be98-d05a0c633d22", "comment": "Malware payload (CoinMiner)", "value": "d529f51281cc48f0d47202bd9af2087a50e01963492dae28551eb43c49eae254e2a0d46352fa450d44744428c039b59b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922277, "uuid": "f38b642d-0f7e-4cb3-94f1-f7d6c143e1df", "value": "T1E9F7BF15B3D80A16E63FC27DC2638602E6F1B4531352D6CF0559EE992F53BC1AB3B262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922277, "uuid": "82674777-26eb-410c-be76-fa568f1223b9", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922277, "uuid": "2da1f7ab-0c70-4d9a-b31e-c0b24615e122", "value": "786432:cf+c8Q9yRJD1SpqlOUVp4WUV5OtsFJ1mpbD:cf+cL9ED1Spql9V6Tn4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756922277, "uuid": "69e212f5-ec15-44de-950f-f967511b5ac1", "value": 70227474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756922277, "uuid": "b7a87138-12a8-40a8-8b76-7bc2f13f9e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922277, "uuid": "f373cfba-3da1-4cb4-8137-3b1f080b32ef", "value": "new1.mega.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9f05aa-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1756929994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929994, "uuid": "375855ac-52b8-4be5-9832-eb7e088a0981", "comment": "Malware payload (Gafgyt)", "value": "18eabd78eb30ef8829bbff260691d4c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929994, "uuid": "cd11ea1a-0f6d-4294-997a-8f3d8a7135c5", "comment": "Malware payload (Gafgyt)", "value": "471b920150ff5a011b6abdaadf5986ec54161a9d4092888438ead654f4c4ea7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929994, "uuid": "43c064b3-246a-4e3c-b4a5-148a1d8f4881", "comment": "Malware payload (Gafgyt)", "value": "5aa3cb45688fd2094f0bfd48c54ae05334324fd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929994, "uuid": "97f0ce0e-1b1f-4105-9812-a69177f5b3fe", "comment": "Malware payload (Gafgyt)", "value": "84e93ad18628bdfb0359840c15e7d30af5718cb2cbf7a1563202ad3b06c4318b4b209e17e7d8808d4e3bd49f4f96db4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929994, "uuid": "cc4526d0-dbb0-4487-badd-dcca2c70f533", "value": "T16DC33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929994, "uuid": "c4dfb277-14c9-478d-9450-b4b34a66c907", "value": "3072:idwracAAviNmLpMQ1xz5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxz5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929994, "uuid": "4d29261a-f421-4022-bde2-3bbcbc7061b0", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929994, "uuid": "a32e44ef-770d-494f-b6a0-dd4dcbd104dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929994, "uuid": "d9d1ab21-53a2-4f62-8549-2a9daa070450", "value": "fuckjewishpeople.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ca6a15-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866823, "uuid": "ee7987fe-9f81-43ad-85dc-fef55ef6d28c", "comment": "Malware payload (Mirai)", "value": "05efc8356d3f1f34ed10aa9a5f83495c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866823, "uuid": "3e745677-5b0c-4deb-8a2c-115cd9ebaa3b", "comment": "Malware payload (Mirai)", "value": "4748220384cf90994d310b2462f3f5622d53f14a12939bc208040322873597e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866823, "uuid": "9ebc8018-7539-4d31-bdd3-8d9d368e1f4b", "comment": "Malware payload (Mirai)", "value": "bdad9c6a8220d0ba883866fc13b92760e60ae16b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866823, "uuid": "13c80fe3-c2db-41ca-9539-7ddd248b9a61", "comment": "Malware payload (Mirai)", "value": "d43252826867f021d91cfaec782a809a1b77ba780a6a1a01839f3def21f6437b30f89cbbd6895ccac1a80052e19da7cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866823, "uuid": "a98bd3ae-bb7b-489a-b914-aafcf33335df", "value": "T13263951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866823, "uuid": "05b596f2-506e-4a1f-a3ab-4add9488de8d", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAW:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzdL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866823, "uuid": "f27d3cbc-fc3f-47a3-87f8-c04850fda00a", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866823, "uuid": "63d6fec4-994c-429e-88f4-39e148c582f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866823, "uuid": "0463bf42-681f-4a22-baec-dd44ddbe8a60", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d83ab36-887d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Blackmoon)", "timestamp": 1756873193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873193, "uuid": "cc03025a-0a02-4594-a080-ba8687db60f5", "comment": "Malware payload (Blackmoon)", "value": "52d8fcf145bb8bdd09cb7612400b8972", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873193, "uuid": "114c64bd-8042-4937-85c4-182af43db91e", "comment": "Malware payload (Blackmoon)", "value": "492553d834fd0f43c00a1f8cd8d33e2797ab5745807d372f7cf6fc086168d1c4", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873193, "uuid": "f1df36c8-5287-4993-88b0-aa065e2b5beb", "comment": "Malware payload (Blackmoon)", "value": "b242fd74c310d6fe10d70c48ab1d125546629796", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873193, "uuid": "a04ce998-bbb2-4277-8e8b-c7759202a860", "comment": "Malware payload (Blackmoon)", "value": "9a164ea97df49a6bc6831f0fc28a29a649a82b5aa66c1dbe2b0ff752c09e58a11537687fa5a38aa0ef9310dc53ceb94c", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873193, "uuid": "71ae18d9-1b6f-4d52-ba8e-379f3cef6e5f", "value": "T19874AE1374D0C0B7C297113919E15B7AF7FAE6704F728A93A784CFAD2E72A41862B117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873193, "uuid": "e8c8eacd-3363-4b13-9159-8eab5465131a", "value": "bb20d7e7bca493919373b753bfaf2d22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873193, "uuid": "955286cd-61d9-412e-80c2-5859e242588e", "value": "6144:G3sSAmi8io6q3pIEreGjyajqxT/STPKt:8sSA3hojRreG2yIeTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756873193, "uuid": "d26773d0-ba71-42f2-81b2-d31488bbaa7f", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756873193, "uuid": "aab3ab90-74d2-4967-9b9b-716de45c0df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873193, "uuid": "c78b0a64-b60e-4b7b-819d-e5972ed30c4d", "value": "3DExplor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b96b19-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929977, "uuid": "80c7b267-4339-489e-971f-0f09db29ccdf", "comment": "Malware payload (Mirai)", "value": "014385a3641dac5d98299b4dadad397e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929977, "uuid": "73abc7a4-87e7-4d81-be6e-5098190539a4", "comment": "Malware payload (Mirai)", "value": "49fa3cbbb2d7f43099bc392f0fed27048ea36824c5e8e1fc155d4384cd4ea7e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929977, "uuid": "70cdeb3a-44df-4381-aeb9-ecf30a509cd5", "comment": "Malware payload (Mirai)", "value": "f5668d639478f1077124275a369e7f0c586edf19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929977, "uuid": "813f633d-807a-4cc3-9a73-e3ff17cad926", "comment": "Malware payload (Mirai)", "value": "b40d3eaba8db845130c3b7477de4b036805f6e579f4d6d24246e7eab94c2f96bf34aef05bfb816276c80081bde96b408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929977, "uuid": "45b9663f-d1b2-4168-8ce3-a9054a82da6f", "value": "T104436C07B580C0FDC89AC0B40B6BB63AD937747D1234B37A67D4FA272E59E211E2DA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929977, "uuid": "e2e78d01-336f-4c5e-af3a-7346daa62363", "value": "768:wDzA/NvYVz1Axb3Gunh0zzeVN5VlhGl+qo4VG8zTnFFFTptY636k8OxT2u031QOP:d/JYN1AxSd6VNlh8+q88zTnBb12u0FH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929977, "uuid": "2b4e7b0a-3330-4650-a298-1787834e4673", "value": 58960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929977, "uuid": "d43bde01-4cf6-43d8-813d-9b38ab3c0fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929977, "uuid": "7014533d-1ed8-4843-8dbf-aebfd5715fe4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c51099-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1756891895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891895, "uuid": "6df1baaa-1a3b-4aa6-9a2d-e69a2dca38f6", "comment": "Malware payload (AgentTesla)", "value": "264e16ac17bf65ebeadb5774129fa204", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891895, "uuid": "4f73e429-9964-4563-954f-660e4143536f", "comment": "Malware payload (AgentTesla)", "value": "4c92199d0fc59441c280dd2f9d5f35f10f1d995ceda78b1ee2003438ef168036", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891895, "uuid": "c816cb73-3975-49a5-b4d3-514639671d57", "comment": "Malware payload (AgentTesla)", "value": "a4f3ac6a7008b42b0208a31edf167c571e89fb5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891895, "uuid": "aafd4d08-72cc-4d1d-9d8f-e00c832e4632", "comment": "Malware payload (AgentTesla)", "value": "590376d7ee17db6b62793f18b6d90485a66a285ec61847fccb359db69cdd5c3dfec6a949f2c727ca798d50fff87cfdb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891895, "uuid": "e337a8d9-33b8-4a01-8cdb-c36cc893291f", "value": "T1A551A7843F82F1D61B5252934D1F48867636DDC2D066862DA53AF0D67D1CB21CB8FE70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891895, "uuid": "256bc812-9d63-4dee-a35e-4831c0a0c6fa", "value": "48:RsdMXaVAhmwSFi902OXPyFPRV15piwwbL79p0sTEliazvwUtUMKbgcAmLzJicxWy:Gwwi90pyFPj5cL7w8mzZUMKzzZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891895, "uuid": "f98c69ad-0e28-4a83-b222-52ba11e9cc13", "value": 2992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891895, "uuid": "caa0583d-1f60-49bf-8c6d-75d3bb9dbf2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891895, "uuid": "c0193268-88fc-41e9-87f6-43e198b79bff", "value": "[Invoice#250812002]_Update.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec67dc3-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866779, "uuid": "9dcf6d4f-e353-4a63-8be6-09cde53ee357", "comment": "Malware payload (Mirai)", "value": "1dd88e4c1f95a8ebea9a7d1fb0c4e4f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866779, "uuid": "45d4143f-92a9-4d7a-b869-8000452cefda", "comment": "Malware payload (Mirai)", "value": "4cd96a17abe5a95d9bc1e57f07a36c1c60173c7edb87486765a54a7099096be6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866779, "uuid": "2e9280cb-c660-47ef-8eb3-c3f5173dd177", "comment": "Malware payload (Mirai)", "value": "9f628205b3c7eb30f7a7674c0c1a19939485fd96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866779, "uuid": "b99266a9-d41e-4b5d-b0a7-6f7df7f33830", "comment": "Malware payload (Mirai)", "value": "4f74bb8388a446043c81fbf254c3c6c45d09b12cf6fe9ef341c49158383fc41699198932b7f47897d28b3979473a1512", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866779, "uuid": "52da885d-7b03-4e01-baa4-ef537eadf878", "value": "T192A2D11172A32D65F3ED2C3DC9AE8357F9671BFC90F6327569401A20C94D24A2E39B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866779, "uuid": "1c35deb3-804c-4e5a-afac-a22e56afbfbf", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjNRMhymdGUop5h3:vvQn4j+ZO5fKAlxks3UozF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866779, "uuid": "0103cf37-bf00-4235-ac00-e8b9340a86bd", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866779, "uuid": "d50e7b94-8158-4ca5-927a-f01eba8944a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866779, "uuid": "5a93d877-72c8-4e91-bcae-15a3f684dc0f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6e89bb-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913294, "uuid": "13aa1399-adf6-431f-9a35-385a920942af", "comment": "Malware payload (Mirai)", "value": "36458e6038054cf440bfd6f3245b1a7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913294, "uuid": "9632da88-e039-45d9-853b-1a42327e3a4c", "comment": "Malware payload (Mirai)", "value": "4d7415c458b1c581dddb7f04978a17d0a2aa5190b1703ee91b5ae3b4c7785abb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913294, "uuid": "ec8c863d-bd69-4f66-bb83-6730d8ce8cf8", "comment": "Malware payload (Mirai)", "value": "3a70f5a8796556fe492a37a6a49ae06d1dc29145", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913294, "uuid": "75416a5c-497b-4019-90af-af2fd08a0c10", "comment": "Malware payload (Mirai)", "value": "05ca3214c24c10112709281b0452e3c8ff369b2dfdd25da5e7e66f7de981a559b992b9473fa2db4791877afdfe2d44f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913294, "uuid": "09929de9-cfc4-4857-953f-0cc753639565", "value": "T1D9A2D165E1D59FB0F6FC6D70ADD1E280ABF20FD47A958EA300442F26832A8576748ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913294, "uuid": "133bbef8-5e5c-492f-8b10-44f4fba037da", "value": "384:7/gNyF/M84Tp2YshxqlDZv4nO23Y1n3nkxRvnKx3bM4uVcqgw05VxJ1:7oNytlSVsMDZgF3Q3kGJI4uVcqgw09T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913294, "uuid": "abc1861e-7402-46b4-acbc-69a30bac296a", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913294, "uuid": "040ebb59-2619-49e7-bdb5-4d2fa823372c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913294, "uuid": "3a68be19-1d09-4cb3-98d4-cabc45435c54", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f37538-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929951, "uuid": "0ea333d3-a432-4918-9bce-da101d9ef83c", "comment": "Malware payload (Mirai)", "value": "ff51693d82aead636c6943b0ffa4fb50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929951, "uuid": "41c4389f-53ec-47c1-b18d-5ae13149f706", "comment": "Malware payload (Mirai)", "value": "4dfd651839fedd4b92a5571115fcd1a0e53812d66d23905c9aa197e42ba49b1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929951, "uuid": "eb9db0aa-47c4-4fec-9169-e4a09d5e6001", "comment": "Malware payload (Mirai)", "value": "48d6f6e4ae5056642e92aaf71dc9c0e0cc6a46fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929951, "uuid": "f44a7a17-5e8d-4472-b280-8afd0b6573cb", "comment": "Malware payload (Mirai)", "value": "80d147d080c1b305940aaaab25dea0ed931dfb6bd87cbcbc2f0dd930f66adc342c1841301e009693c0d7dde53865f893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929951, "uuid": "4058393b-71ea-4502-a0fb-484748fc3812", "value": "T1CE336B86AA83D8F5ED6709B41137AB778736F4391039DB82C765E931EC12A10E62F35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929951, "uuid": "c2d35af1-480c-41fc-bcd9-83009ed830d9", "value": "768:oLrHESabipD2hTIVjD9MVqK6aaNOP3IlCrbm848KJzmlx0p+CBMrLIh:oLrHEql2lIVnwuOv+Cvm8iYUvMrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929951, "uuid": "4f9164be-f0f8-4805-a453-1b60872daa79", "value": 50932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929951, "uuid": "0bfe7ca0-14e6-484e-8f39-01c78bbb41f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929951, "uuid": "db542f7a-2a52-4320-bba1-7e1cb36f6c19", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5c7d42-88be-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1756901408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901408, "uuid": "8729e9e3-31f1-4739-a472-e96b15dfd9f4", "comment": "Malware payload (VIPKeylogger)", "value": "75c1f46a98c8cdcdc230c2976fb23351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901408, "uuid": "201b9f10-c5c4-41b3-80c2-7bafe0023022", "comment": "Malware payload (VIPKeylogger)", "value": "4f8eb431e07cc4c69fc41ea1e564f99651dc65931073429de3e532a904fb0ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901408, "uuid": "7081bae7-58cb-46d1-ba7c-42a14e143434", "comment": "Malware payload (VIPKeylogger)", "value": "7ca39e815bd5ee9f3285023fd851a437af195331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901408, "uuid": "af79947f-0816-4265-9905-2a68b4e9166e", "comment": "Malware payload (VIPKeylogger)", "value": "e186f6ed830a4441afefa7de2831824309108acd86791ecd77d64f0f18b3ae626c0535468e30e1a49753d6ecbe95a4c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901408, "uuid": "86ad53e5-f0b7-46fc-9d0e-0e26760a4325", "value": "T159F4DFAC3240F4AFC467C9729D94DE74AA246DA6930BC203A4E71D9BBD0D997DF101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901408, "uuid": "236d7fcc-7d51-4c5f-bdb5-d764c1c052e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901408, "uuid": "da23ce6c-06fa-44ee-b2e7-27f334f01c61", "value": "24576:68vkmJJC2JjX7049omywn5MvNnPBKTX/EmPEWu:fMmJMOLn915KnJEX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901408, "uuid": "659ef88c-7fbd-4e57-969e-1f96a7c32ced", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901408, "uuid": "36b9ad40-227c-4c34-9c8b-33b1e1c402f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901408, "uuid": "f84946f1-3382-4c61-a8f0-ee3089aa555e", "value": "RFQ NO_61000112038_AIRTRONICS QATAR 25technical bid submission_sheet SC0002521343 order 3400787112-002.pd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822e58fe-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872878, "uuid": "97f98e30-a21e-4214-abb6-d31d57f0d796", "comment": "Malware payload (Mirai)", "value": "6515baa97ac936930b3464f5691f69b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872878, "uuid": "31183d1d-29da-4a77-95ea-66eb542d24fd", "comment": "Malware payload (Mirai)", "value": "4fbeddcb7a39bea4cf59ed9575dc4638fa8e567cef782d431ffebdcb919a7ff2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872878, "uuid": "48e40bc1-05e6-46fb-bbc8-3638ef5952da", "comment": "Malware payload (Mirai)", "value": "3c5966dd1b22906a1ec4f29154739824cb56330f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872878, "uuid": "5f0d7b43-54f9-4a5f-989e-d8d5431534b2", "comment": "Malware payload (Mirai)", "value": "d6a640195a65c65d6ec4d8a419ee4892829fa1d7f42755dbd40e7f227f8b3ba243a1a64f7c9a534205838fa717de5bdc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872878, "uuid": "4788da71-54ff-4adf-bb68-f30625ce2b20", "value": "T1503181CA54A096B67CE49E8B756AC80E7016E58E1DCA5F89DECC31FD58DCD81B061703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872878, "uuid": "1f9f0229-8e7b-414d-a8c0-b09d79075f23", "value": "24:sF+l/2rvQT/2emc/2gAd/25HBtl/2n8t/226s/2MX/2Df7/2lR/2zu2O/2L:eiF7JcN8K8t5PSLAUuZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872878, "uuid": "98754cf8-0aeb-461d-b138-c67f1d7e1715", "value": 1582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872878, "uuid": "57fe9cd6-9bf3-4c41-8a2b-61305684b9fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872878, "uuid": "9a29aef4-9f3a-485a-85ec-883d28d522df", "value": "dvr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64552f30-88d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756911913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911913, "uuid": "fda71e58-ac93-4abb-a36f-50d76dd13f02", "comment": "Malware payload", "value": "29c8d89d0532c1bca4e3be693e4ffe1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911913, "uuid": "bfa1dcdc-c50c-44a2-b020-6a27cbbf0c49", "comment": "Malware payload", "value": "501a03c91a790c1051c51aaa96b032f164b7af8a4f6cc23c825900d0bf5d5e29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911913, "uuid": "223a3411-e2af-4a4f-b64d-e5838fdc3699", "comment": "Malware payload", "value": "7533fdaf19f9294b2624db59d92c8dc52b3a34fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911913, "uuid": "9cc68ee4-b00f-4076-8c2a-4c859198e6ff", "comment": "Malware payload", "value": "88a71ce59c87ba3ff730b0dc0dde62b8f37dd505a5d0744176ddf1bdfa4e248e5ad2ce4579c7704b704e868313912c58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911913, "uuid": "2d3ac0d3-de1f-490d-b02b-629c11ecf76b", "value": "T100459D97BF4C6E47C6DAC33E8A9683701337E986534392073944A23CEDE3B99CE91945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911913, "uuid": "ebb48580-12a0-481f-8f0f-8ae824193394", "value": "12288:jGxykWG4R0xo0WiBW/BoQgaXP5fXGud6Kxg51O7va8VynmnF4c4dV/mnp6p6DLzZ:kdW6HBUoQ/XP1j7TYz+Ep6DH0JctHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756911913, "uuid": "d3af5045-a1c9-4166-8bef-32c87f2db2e8", "value": 1253992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756911913, "uuid": "573eb1a1-e6c2-4ad0-8eba-6831257c74ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911913, "uuid": "0d00ccf8-55be-4fba-9fc5-01781eccf717", "value": "test.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ed83df-8906-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756932177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756932177, "uuid": "bdf349b9-55bd-4d5e-817a-5f5026548a4d", "comment": "Malware payload (Mirai)", "value": "ef16341fab41d3c9cf70291aa40c3333", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756932177, "uuid": "1a5bacf6-06ab-41c2-8bc2-161fa7c60201", "comment": "Malware payload (Mirai)", "value": "511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756932177, "uuid": "08b26f82-0b5f-41aa-95ea-052fcaef3f36", "comment": "Malware payload (Mirai)", "value": "c439b914de2aced88b73984a7c59d9b164e88530", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756932177, "uuid": "34154c23-f9ea-4fa5-a2e5-dadae8871f04", "comment": "Malware payload (Mirai)", "value": "a08fb17fb43cfbaf05c830dbb19ba2676032377297540c5e5f2892e45999fa0728c3a1285e95b0f78ce2fb36e06d3f57", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756932177, "uuid": "de5db7a9-9608-4373-a754-371328f63f06", "value": "T16AA191F5742897BE2DA0AD7365DA8542B25125B6E1DC0C0AE7D6F0E50D4CF71F890E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756932177, "uuid": "f1c78a6b-c6f6-4a06-adff-85a911d2116e", "value": "48:vIZMV4kgIu1V4kIrHrWV4VIVoV4XIEBEEV4EjIhkV4DIu1V4kIiZV4YIzSV4FIDV:vbKd7f2LyfWEpjbItX3dzm7gBt/R74Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756932177, "uuid": "1ad8b537-b0dd-40e5-9e91-7eda524e8358", "value": 4732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756932177, "uuid": "0b1199b1-f5c1-4845-9318-d952b198b093", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756932177, "uuid": "8a4b7647-a12e-4a67-866c-b8aa66bcc23d", "value": "76d32be0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6a6b6f-88a6-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756890913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890913, "uuid": "0f4d364a-cdff-4d0f-9410-0d8473c819cc", "comment": "Malware payload (RemcosRAT)", "value": "621596e1556a48cd907767d82cf90651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890913, "uuid": "2e92a2f7-c423-4a1d-9beb-38eaa53df8e2", "comment": "Malware payload (RemcosRAT)", "value": "5135308dec04eaf8d683adb9fdff45cbfceefdec51ee054a22fad2e771e1c65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890913, "uuid": "d087482c-b747-4e53-bd19-449072190b88", "comment": "Malware payload (RemcosRAT)", "value": "1794238c75aa370debd98ff28992c6f6e3cf8601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890913, "uuid": "ad2982c6-e63f-40a1-b2ec-ca9f20d76d1e", "comment": "Malware payload (RemcosRAT)", "value": "0cf704588cd4e4ddf69566eb71ced3c357365bec5414f1bb975168fc7f1ebe19ebdcfb5adc1001ba378c277abcdef4d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890913, "uuid": "f1477aab-3529-4613-a80f-7ad22dcfdf39", "value": "T11B84131067B4D087CAB96EB09D2697FA66BCF5641A20D38B0370EECD78633519C153BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890913, "uuid": "4a6ecd4e-34b6-43e6-8912-6d939e279e96", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890913, "uuid": "e6adba57-0d7e-4626-b9bf-67426f7c4a0b", "value": "6144:zmOPrFRqPRZwqf1u4WwcSRqHdZqmtStWTtMpYjr5jPpC8+vR7T5nQPB8y11jx2TD:vFRqpZBfCwWQ4mMpuvRf5nQPBASol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756890913, "uuid": "a94ef1a8-8f0a-4368-9d9d-ea8f2d31c198", "value": 395008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756890913, "uuid": "fff0f511-ae7d-4e3b-82ec-32247d50b0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890913, "uuid": "a7efa9e1-7a9d-451c-886c-353fd82a0908", "value": "ZLECENIE2025090015030001058029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ec0239-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894004, "uuid": "764e96f5-281f-4e2c-b033-9c9fe159328f", "comment": "Malware payload (Mirai)", "value": "47dc2aa883d24c37cd8bdcd763465260", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894004, "uuid": "2d201611-df54-4840-b9ed-2ea7a6352507", "comment": "Malware payload (Mirai)", "value": "518bb7ecad7786975b925e68c15f70746e6ab02508deb8bbbc8b8cc5cc597355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894004, "uuid": "6f92b1b8-9646-4d84-9e4b-bf2e1ccf57e0", "comment": "Malware payload (Mirai)", "value": "e9c3b17f830d22583c3b241fa87ab714e9c2b940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894004, "uuid": "4857c1e0-ebb2-4ea8-85ec-5d6be09ca6d8", "comment": "Malware payload (Mirai)", "value": "0a233b5610ea2a2125f40a7ca0e33ec3b9fa6cbade20533618a086b75011480db619cb6d2f2e49cc4ecda59876cdff87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894004, "uuid": "b2ae4de5-f62f-4eb8-9e2b-6543670fa782", "value": "T1EED2D1B91B06478EDE6EC8FAC3E413A016354E12A903FC4A74DCD7476B6B9C4A607ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894004, "uuid": "14c26ed8-e302-4fb6-bd77-de9a702db40e", "value": "768:yxMWBhAHuLegF1aF4NscfOl8liVgj9yDJgGlzDpbuR1JW:yxdBGuLea19acfjliCKVJus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894004, "uuid": "b69d0002-40b6-4974-80cb-3737a5e205be", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894004, "uuid": "c35fdbde-e79e-48c1-8c31-ec959447bc88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894004, "uuid": "91f92f12-2d7f-4566-a552-31b455ee74c4", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2b23bc-88ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1756894179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894179, "uuid": "5d5961d9-78cf-46b6-b627-ce052c88081b", "comment": "Malware payload (PhantomStealer)", "value": "906bcbee8b654b0c2b96d30978b306ed", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894179, "uuid": "4ded6e72-a6cf-4bcc-8af2-10bd71e3e4d6", "comment": "Malware payload (PhantomStealer)", "value": "533c57a4282a151a8c8e4170eeb0fd751e33744bf2cbd8cdb40d71c90b01a448", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894179, "uuid": "133e5f77-0564-408a-9a3e-af92feff6cf1", "comment": "Malware payload (PhantomStealer)", "value": "9e36c77ea66ae030ea948e8a2183dfb95d25fe13", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894179, "uuid": "ec3ce183-026e-4651-92a2-8ca30b1df0f7", "comment": "Malware payload (PhantomStealer)", "value": "97f62af055451619795531dacac5ce90fea1036df7c58bbe0124295f77af15e3e53ac50f102ae9a438aee70b5d938302", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894179, "uuid": "47dd253d-1216-4cec-86b3-c8ef5120ca09", "value": "T16BA2E164CA1B755E91795D2C3841B9809CDFF1EE0287D8820FCF98858E9D1EA7CA3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894179, "uuid": "9894b40f-8668-4e97-bf8a-feb8a9ceb760", "value": "384:0NqY9CJ9cDC34EPaafU9Ujkb4SS5QQc8jn3KyzA1I2IKC4/7866U6VOnW0AwP5y7:8qiDC3eas6QbVSQJ66CA1I2IKCM78U67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894179, "uuid": "468d1321-64ee-42c5-a3dd-493f8b7b6bc1", "value": 22946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894179, "uuid": "754b6e45-ef9b-4b9d-b4c8-65fb49dfeaaf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894179, "uuid": "cc7e8767-b004-43e9-bfb0-89cf6289e745", "value": "Sales_AQS RFQ-1180-25-Spec-Outlined-BD7009.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b272d4-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756872878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872878, "uuid": "481a0670-1192-44c7-890f-2d608c87d3af", "comment": "Malware payload", "value": "8c4e11e3063fd907e541d4a81547ac98", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872878, "uuid": "fe80e504-e29a-471b-8431-44850a4f4f4f", "comment": "Malware payload", "value": "53ad9731fa855c98d6f2befd2b31a52a28cb1eadb4d72424e56f3896f6516f63", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872878, "uuid": "6cc02925-f850-40c5-906e-30fb80465148", "comment": "Malware payload", "value": "fc3a449c095e60d3e612d5931ecfb77a7c14aa02", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872878, "uuid": "a651a2df-27ae-4ef0-9a5b-4ab95a87fd01", "comment": "Malware payload", "value": "595bbee6def0997794d0e468cd60d36179d01070a3980628e7d0e5203ad89988d3ab888eac78a6a6ec007f7e7f9ede5b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872878, "uuid": "a2d14666-b8bf-498d-b0db-1dccb89cf70a", "value": "T18BE0B6C4F42236F35FCE6C4FB372881A1866E14C4496A2D6EE5A906D9174F45F531305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872878, "uuid": "10b07265-2492-4cfd-a520-f0faa5a5f7a5", "value": "3:6XtDVLf+gqXUvUSidHeKzSIO1aiiEDVacRgqXUvUSidHBEzFaDSINXsFE3iBqVtT:aSF5e1jakF5yzFbE0E3cRF5Ma0LKif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872878, "uuid": "876918b3-7ef0-470c-947e-d25aca8326d6", "value": 314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872878, "uuid": "a434a61b-c12f-4db4-a830-5301c067140b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872878, "uuid": "1e8fe388-d2b0-48d3-87c2-ce47dd74e5f2", "value": "av.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0af691-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756930177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930177, "uuid": "bb4da0f6-8690-441e-9834-2f3c6236f042", "comment": "Malware payload (Mirai)", "value": "5050db2829e874657fe5e1d8345b6852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930177, "uuid": "61310760-b2d1-4b51-b12f-90d58226ebc3", "comment": "Malware payload (Mirai)", "value": "55a575018bece5cde605d95b2bb9fb825708e2a97ae09e4f1e436abaf5b65e93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930177, "uuid": "07c73acc-dc7c-4aad-b81e-ae12855680de", "comment": "Malware payload (Mirai)", "value": "7ab89c3aba41a942cd6b76ee34e0884d5ca111dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930177, "uuid": "15286789-7f8f-4041-8860-26bdec0ed364", "comment": "Malware payload (Mirai)", "value": "41937e2bbb885315cacd126e6e5daf8f1b5f3996b129b6f44517b95ee5eb28a8b4cb45022328f230c72b9cbee63154e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930177, "uuid": "6a83c0ae-1d0b-482a-86de-47a21da92772", "value": "T162731B95F890CA32C6D156B6FB5E428C73130778D3D93202DD249F3967EBA5A4F36902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930177, "uuid": "4f7dee69-b8e3-4282-8073-6dd951861d5d", "value": "1536:YjOVA4jwL6UwBA7FN4ASpxQnY99F/3OM2M4+9LxeEsN4q6HNgpsTOW9QGIr:Yj+A4jwL6UwBA7sASHQiUM2M4wbsMXdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756930177, "uuid": "35d9414f-5dc1-4c4e-a856-6cf3751d6d27", "value": 75020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756930177, "uuid": "9bc41176-272e-43b2-ae3d-e93d9f4ef0a8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930177, "uuid": "8fb61506-59ba-4628-bd4e-8237d4264418", "value": "kitty.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e6c820-88d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756911997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911997, "uuid": "a7d0980f-c27b-4f58-802e-d376a02277ca", "comment": "Malware payload", "value": "da4993e9b296ae4af93f6b280856e02a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911997, "uuid": "0c3441a0-1376-40de-b1fe-771ff2fd11d3", "comment": "Malware payload", "value": "5632b27e54a554008377a56bbafa640e0d30cc325ae75da7b9c938e9f321f63f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911997, "uuid": "c9d2376b-7d20-4ee5-9982-2ea7e8f577aa", "comment": "Malware payload", "value": "110c469d3b16242fab4f0a3e5a5df3febf07c964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911997, "uuid": "5f2ce132-1acb-413a-b682-67c341700eb0", "comment": "Malware payload", "value": "2a25a037637674c761c641e985b5514102404bc1c28bdf2fb694a4706b78e98e24012b3a4a9db73dfa6fac2791aefcb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911997, "uuid": "2985f87e-598c-4a06-8fe0-ca5c1e782303", "value": "T192F31A02732C0883D16B6EF026F757F1839BED9116A6A604E21EFFC46371B715589F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911997, "uuid": "28f95f89-922f-4ab5-8469-c9d223852bdf", "value": "3072:WFyxDm39fNe7PH4kd/HGTtBZM8Ny9ihmNZ7eNIQDx00pm:WUx639fmmxk3QmNZ7eNIQDx00pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756911997, "uuid": "ff262da7-35e2-4245-b253-56e91130ad40", "value": 171260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756911997, "uuid": "fe8f69a7-4ef6-453c-9d46-1db60268f833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911997, "uuid": "b3816463-a753-4390-9678-15cf00e199a3", "value": "test.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00e0e4a-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756891853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891853, "uuid": "fb4a32b8-408a-4d50-bd16-4cd8e0d98cbc", "comment": "Malware payload (XWorm)", "value": "c3abf167d3fdaf222941e0584d8e9299", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891853, "uuid": "afd5311c-3b9c-4278-936c-87fb5a88d32c", "comment": "Malware payload (XWorm)", "value": "5663a73567202c494560a0de0da9c3f5e452e652e0233ca7c281a24ba12f3f5c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891853, "uuid": "655a7cb4-ff5e-4361-95f4-f4ca58f52612", "comment": "Malware payload (XWorm)", "value": "d60b378e20fb601804eb05b6280996a320e38846", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891853, "uuid": "b4f6cb31-08d7-40e2-9bdd-bbadfd0f02b1", "comment": "Malware payload (XWorm)", "value": "5b83c723eff02bd67c986c040af4c01afdfde09e42def56c8242aede9662881e126ea10f209be3c9db756aefb43332d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891853, "uuid": "27d92bb2-a639-44bc-a824-ca47e12134b1", "value": "T1B5D5B1D8FC496FC0A763A52D537372ACAEDEE2E55832B04F41185BE324991A657E3C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891853, "uuid": "81929551-0c29-46d8-9367-fee73a3069e7", "value": "24576:NGMLhavCxdHVEUVzajvYOliuDu53+NlfBqw4SIx14Z203e/F1tw:PVEUVzajwgiub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891853, "uuid": "01dd3ef4-b084-4d9b-b28a-67bb57388769", "value": 2824872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891853, "uuid": "241e3c99-cfe1-4f43-9983-1af3dc6f2262", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891853, "uuid": "75b8f8b5-c8d0-4cb0-83ee-ad9565722542", "value": "INVOICE_SHEET3-ALL.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080790b5-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872674, "uuid": "d7c5f311-3778-4ea9-8a5d-ba221fe0c60b", "comment": "Malware payload (Mirai)", "value": "d229c33d653802279e34a897f7c41cc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872674, "uuid": "ed930e59-941e-4521-bc13-43e071fe9db7", "comment": "Malware payload (Mirai)", "value": "587f59a7d1e5961ffb850d4ead6b0ee2f5ee912b0dfb2f0ecd93a0af9fd9d267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872674, "uuid": "858835dd-6dcc-46a4-a7e6-164dd15df4e1", "comment": "Malware payload (Mirai)", "value": "90f0569c599ab67a0ccd68e782ecb498e6a635fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872674, "uuid": "31853b05-9ba4-4bc8-9486-c1cb3ae1c15f", "comment": "Malware payload (Mirai)", "value": "83d8a2ba95a7b2586ed9a73db8b37dd68a4356f0da23073acab93d31640944454fbf7e12251ec88aa845211fd0fe7395", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872674, "uuid": "181cf897-2939-46ee-b2f2-025fcd599bfd", "value": "T153211F0DF3496C8FDDA76578582B022B34307A5AF4135013A3698E3FBE3B1D4131A18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872674, "uuid": "76b105de-f8b1-4a1b-a92a-d7f8a2d73ceb", "value": "24:3FAa8DzSWPpbP78Pwy74+CibTHdQ8hHoeDD8ECAfG0ioxnxU7NT1KAW:1ApP3hb/mVTdLhIev8DAfGYU7NhKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872674, "uuid": "2e6d33d2-b847-40f0-8241-54158c703751", "value": 1244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872674, "uuid": "13378ae1-2f66-489f-846a-1fa275cb24ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872674, "uuid": "ab18b3ab-5391-43c6-82d7-ae1f838ecb83", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2463c552-88f3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1756923831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923831, "uuid": "6377ab9b-0a09-42dc-aa9e-6955e8021d3c", "comment": "Malware payload (Vidar)", "value": "6e172e6b8be97e5948bea1230cfaaf4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923831, "uuid": "6319c587-f436-4fe9-b9cc-d11030378b9d", "comment": "Malware payload (Vidar)", "value": "58817bec65f9b5e99077cea5c6fff5fb68af2179b3df84897e04a648687deaf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923831, "uuid": "70d1187d-26a8-46f0-83b9-6109ab4a4cba", "comment": "Malware payload (Vidar)", "value": "b430051f31be1060f2620fbd893b94fc7e70a77a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923831, "uuid": "c4b76c80-f7f9-4795-99d3-dc65acfc99fe", "comment": "Malware payload (Vidar)", "value": "5036b0b28a52b4db54fbf951b67e836e3d13cfd0ebd708526a5e379180381ce1944e4348a94dfb07b860a02c99edfe35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923831, "uuid": "1502fa7a-22d2-4281-b572-c85680804f03", "value": "T124347D11B9C1C4B3D967483098F58A759E7EBCA04F61AACB67C41BBE8E305C09B35B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923831, "uuid": "aa1d0f43-cb28-4358-9a1c-84ba8fd03f60", "value": "c673ef005c8b05c71b0d297e41175e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923831, "uuid": "633b50ad-52cf-4adf-8af5-00dee8b5f928", "value": "6144:eJBwRBpb35CBlmv4XZIvajcJriciGN1l:eJBiBp9CJmC1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923831, "uuid": "5673a67f-ff4b-4169-9f63-e30904aa75e5", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923831, "uuid": "1faf2324-393f-4a84-98eb-e10fee0d03bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923831, "uuid": "8f712fd5-343c-4cea-8d0e-faec0b7757a9", "value": "SecuriteInfo.com.Win32.MalwareX-gen.89889669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b86803-88d7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756911885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911885, "uuid": "d15d431f-de46-44a4-a181-ffdff7451830", "comment": "Malware payload (Mirai)", "value": "73ea08dd5e309c2cdbdf228f8437d962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911885, "uuid": "889828ab-ce4b-456b-9598-6023f2c0f994", "comment": "Malware payload (Mirai)", "value": "5954151d5d5cc15a1ebed5a7b631d06f25eb9fe922f9ae01f9fcfc832d5d2688", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911885, "uuid": "f4bfd3ef-12c5-4e39-b61f-180cea50e8fd", "comment": "Malware payload (Mirai)", "value": "444cfa8ad476dee51e7447b27a59886cfc885f38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911885, "uuid": "d6fc3843-4303-408b-a495-ef74244f1fef", "comment": "Malware payload (Mirai)", "value": "19f2fc2ef43cb2b3f1b3722658dac98c400e4494b7ab9ddc5f972be3aaac0a29afa0066e63fc3d313a9a93f6c750cd8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911885, "uuid": "bc1ec027-a64b-4866-93a9-fda911d33e95", "value": "T132041A05EB408B43C0D32BBAF6DF435173239B54E7A767059628ABB43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911885, "uuid": "55519ebf-28bc-4ad3-a354-c581f034ac03", "value": "3072:NxUXvlO9/Ua1r2CFTtzht9fI9TkryBG3nM/Rsf8EEJ:Nyfc9/Ua1r2CFpX9g9TkrgYnM/Rsf8XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756911885, "uuid": "0be61c5d-bdec-47d3-87d4-d6937dadefa6", "value": 175372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756911885, "uuid": "10b3c36b-0eaf-4742-9288-1065d1d52e01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911885, "uuid": "944573b5-d7e5-4cd8-a2bd-1c092be15764", "value": "test.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cc5b50-891d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756941824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756941824, "uuid": "99be9344-eb38-442b-a28f-4887b6264079", "comment": "Malware payload (Mirai)", "value": "85e303fbf008a6d5469173e19a96cec7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756941824, "uuid": "562443c3-1531-4b75-987d-7c594b9f1c2b", "comment": "Malware payload (Mirai)", "value": "5a85d5a30baa4186cedc8011b8f4cd3121f8a7e8c85385e0b595b0ef34d2dd35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756941824, "uuid": "a2be6263-a6ae-4c1e-80aa-3405a2a004dc", "comment": "Malware payload (Mirai)", "value": "bb40d8bd6929cf3ddae0aeb760c656f5f7cac566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756941824, "uuid": "09b2d82b-23ea-46b2-98e3-e64878e13fb6", "comment": "Malware payload (Mirai)", "value": "68f03001f3d4ed537cb5577581316a8939c6d766ad8e0d7d33871d8123a844e12785442f226dc016948c3aaa4c02d0a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756941824, "uuid": "c133bcd9-c85c-4902-8a42-905c7ba5656b", "value": "T16B13F1AEF03BF6F8C406D0B3855D8F85FEB2349BC6086F57ACC5629B857EC596920142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756941824, "uuid": "14a95876-774e-43b5-926a-497575c03222", "value": "768:GowaWeonW124Vo3YP1aB7Gwu2pBo0uQGCyM1B1qEo81RDY/9M8Omv+TcIvxx0K1:DlWs124VYYP1aB7rusGp+Br1RDYOAv+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756941824, "uuid": "4dddaf4d-df9a-4404-9691-aaf26be863e6", "value": 41916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756941824, "uuid": "23c55b3d-0c2a-422d-beff-445fb10bcfa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756941824, "uuid": "b8689d2b-0590-4ac2-a38b-935ae74d17fc", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c6b7f1-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872883, "uuid": "d50df2a1-8bba-4c6d-b96c-36f2bf482784", "comment": "Malware payload (Mirai)", "value": "bac65592e8bc1da768dacf7f333e7753", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872883, "uuid": "c775f665-30bd-4736-a3be-bfece97da587", "comment": "Malware payload (Mirai)", "value": "5ad6f1124858463013067724e2fd5b56dceee0ff06e0f43f67ba11f4d6ece7ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872883, "uuid": "ef7e93b7-1285-4f00-8c5e-2734c424ee3c", "comment": "Malware payload (Mirai)", "value": "8410307ca5bef16b097c6872d38c14c43b88e67a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872883, "uuid": "69d6425c-3f9b-4203-9f6f-9bc4794d8f73", "comment": "Malware payload (Mirai)", "value": "c87d29bce0fda07800880fe82daf02eac0616d64c389490ebb9839ddeb6483a17a81ca6a903f5cb8a6e07ee885ddd288", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872883, "uuid": "979564fe-502e-491c-a330-f24998aa80c2", "value": "T1DC3171C994A186B67CD4AD8B766FCC1E3016F58E18C95F89DACC30FA988CD85B051B03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872883, "uuid": "13e3ddea-52a6-4563-99bb-5398aadd8385", "value": "24:sF+l/2rvEfT/2etEc/20Ad/25Ztl/2nIt/22+s/2IX/2D/7/2VfR/2zbO/2H:eipj71cNoKQt1HSrGZUIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872883, "uuid": "80e38664-8a18-4d81-8763-767aba95b419", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872883, "uuid": "a1cef72b-ed3f-4b61-9e92-33babbeaf886", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872883, "uuid": "b5a12a5b-abf5-4051-b88c-bccbb7d34f62", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d463665b-888a-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1756879029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879029, "uuid": "9effb984-cd0d-40e6-9d51-758fff8289fc", "comment": "Malware payload (SalatStealer)", "value": "a0652543c49180d44f02486072c080df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879029, "uuid": "7b04b7c4-3e6c-48bd-97fb-fa3f55841931", "comment": "Malware payload (SalatStealer)", "value": "5d72c26f7c2e808cca4b06ff8a0704afadc4d8a71bf9c99925c60f8ce36168a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879029, "uuid": "65a188d1-1d4c-4f1c-bb00-2c6993690b6b", "comment": "Malware payload (SalatStealer)", "value": "5abc90d787c1f0f4ed4d767e6e958cfdbd767c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879029, "uuid": "4cf95787-24dc-46a7-825b-c577eb252342", "comment": "Malware payload (SalatStealer)", "value": "f8fdc5bff4f2cc42606fac4ed7ac5e934cdcaf63856a69b4131712f9cefdc12f80b1a8f2996748abb2aa469b77d2b8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879029, "uuid": "60af2d82-978c-4b5c-bfef-0d6c984fb83e", "value": "T1FFE533CDD2453688EA023E3426129AD79FAD3915FF34CB17D16CA1238B052916FDBC9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879029, "uuid": "49bc57ca-7d95-4369-b2a5-1c221edfc8b0", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879029, "uuid": "1a7da673-2377-43ea-bc99-7e51193deb18", "value": "98304:Y6KDglgo1oWDo1mw4Uza73xr4USeOZ3JwySn:Yv0lgo1oWmTy3xJ4hDSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756879029, "uuid": "b5153c1c-f2b4-46a7-bf26-1c44cfc793b1", "value": 3287040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756879029, "uuid": "a594f947-7e84-4c97-aaf9-7f2fbdd9de86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879029, "uuid": "29183749-88e0-445b-905a-d87fa70e06be", "value": "a0652543c49180d44f02486072c080df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9d6471-88c2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756902770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902770, "uuid": "aaaae4ba-2b73-4e0a-9925-f5f793971f9e", "comment": "Malware payload", "value": "28f3a08233c2ab0388a6147d09d555c4", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902770, "uuid": "2c4f0791-da80-48a6-b8b7-b6f607190ca1", "comment": "Malware payload", "value": "5d8ed12dcb1546e3eb22a5a928cd3f96f79106ccce283c4b1965126c37cab2f3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902770, "uuid": "0a484405-8cb5-4e16-85fb-cacd843311b6", "comment": "Malware payload", "value": "d4cce8e7c4b2cddaf89a9a10a778e9854b1dcf34", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902770, "uuid": "e1ef4897-adc7-4362-9255-b7dda9d26272", "comment": "Malware payload", "value": "dcaa8e6bb78d9918d8d65038eef630c2175d3b8b336acfd7c97981aafec896c70f100b011765ef14eae262be05f475ba", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902770, "uuid": "b4158d65-cd6d-4b25-8649-9a28033ca93a", "value": "T1D521EB105BE94B26F2B60F321936B3259AB7F809E915871D4088818C1C36B15DE38F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902770, "uuid": "f7f2fcb4-375d-4de9-9192-007f4ce7c3db", "value": "24:8ecCwJ3zuOtgA56d+/x4dHqii3d0ounYqV5pvpSwyn7mLb:8ecCwVzP3B4dHK7mBHRc7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756902770, "uuid": "fa59a2b4-9d6c-43fa-9c5e-66f004006069", "value": 1289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756902770, "uuid": "8b2effb1-53bf-4540-bc4b-f1e80efc6b2f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902770, "uuid": "db6ff243-d923-492c-81eb-6d24060c8dd7", "value": "Rechnung 5605355625.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87023c11-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872887, "uuid": "fc6c6e22-dcaf-402d-8530-a60b3550de9b", "comment": "Malware payload (Mirai)", "value": "3f60c5f0dbc686775939882fe6c402a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872887, "uuid": "fed34395-a79f-4a14-8dd6-864f6f1c46b1", "comment": "Malware payload (Mirai)", "value": "5e05d4788fa7e904fa978605d2a53cc04f913ac5dde45e24c0b9b8526540d49d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872887, "uuid": "373bc9e7-5d1f-430a-967f-5990410d6905", "comment": "Malware payload (Mirai)", "value": "92527b34de87f86b54ce967da965da22def14a53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872887, "uuid": "4feba91a-3937-477c-9bdf-e99f49609e72", "comment": "Malware payload (Mirai)", "value": "9879df91c227e46e2fb0ca914df67023e957e1ec76829389ecc22a77f151e01ad411419499490aeeea68b865cbaad22b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872887, "uuid": "d191717a-6dcf-4600-bf42-1126ce279f41", "value": "T17D3161C994A186B67CD5AD8B795ACC0E3016F98E1CC55F899ACC34F9A48CE92B051703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872887, "uuid": "7531db36-4774-4963-bba1-b4b12d1cd70d", "value": "24:sF+l/2rvkT/2eic/209VAd/25htl/2nJCt/22ms/2SDVX/2DP7/2J7R/2zjO/2n:eil7Fz4NQKotNhtSbglUgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872887, "uuid": "4323714c-6c95-4ab6-ba2a-35a9a0af9461", "value": 1560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872887, "uuid": "9006eb58-0f1d-4f45-b48d-68fd49b876c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872887, "uuid": "f3dd976d-4fb4-449f-96df-537972c8d82e", "value": "ruck", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ebad0c-88f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1756923533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923533, "uuid": "6d03fa8f-2a88-43fd-95b3-63f087dba8eb", "comment": "Malware payload (SnakeKeylogger)", "value": "46de3ab629c95463be3632424f267279", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923533, "uuid": "68583454-228e-42ee-a343-6cc9f02b5697", "comment": "Malware payload (SnakeKeylogger)", "value": "5e83e874c9e9531fff2a59c1d5c5c559901a6d37bcaaebafdbb915392d1cfb30", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923533, "uuid": "67cae317-15ca-4f19-b58b-27a7be3454b8", "comment": "Malware payload (SnakeKeylogger)", "value": "d045f48ea0bbad2934397823d66614e621676ecd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923533, "uuid": "ce758bd5-702e-4d66-ad8d-572cd1e40a9b", "comment": "Malware payload (SnakeKeylogger)", "value": "1231e2a2492bfff1e17c4ca4e017877243454658fb6eb1fe14b21110b299a29cc5d2a6c85f9b0a93ddd101ae8089bad6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923533, "uuid": "e60524bd-0dc6-448c-834a-a05deee52a83", "value": "T193E41285338AD902E5B147F09CB0D3B467692ED9F421D34B8EDDADD77829B1868C03A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923533, "uuid": "c17de540-b09b-4713-aae7-5e142c7441e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923533, "uuid": "dab1ea11-af51-40e0-a0ba-c0566eb8af64", "value": "12288:RPoUZynCdjALs+eDqzBNYjcuLxvC/x9gmvo/T6ic9Ps0JQTGn0OW:RXzGwVDqvYAuRo9RcT6ic9Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923533, "uuid": "d2015561-8596-4bce-9930-4392d65c7e93", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923533, "uuid": "1cd48c75-8433-45d9-9cb1-237d3302dc07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923533, "uuid": "24636608-1cb6-46a6-84fb-382ba8a7973c", "value": "DHL Express clearance DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2888cf-88ac-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1756893483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893483, "uuid": "c0d9ddfa-794b-4f77-b61c-07ffe9855c57", "comment": "Malware payload (Vidar)", "value": "15265c09569c64b11ca5fb26a0b681f0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893483, "uuid": "4ee9e6c3-7abd-47b5-ba04-ecb6fb07e8ab", "comment": "Malware payload (Vidar)", "value": "5f809fd6dfd4a9835a59270b0a82fa23d4b7be207729892f58d4ed0f1cd0ea23", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893483, "uuid": "37efd082-63cf-4a62-a60a-6ae728c2be5c", "comment": "Malware payload (Vidar)", "value": "4ad3ad8ece42c102803801177d1a324cacff6fc6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893483, "uuid": "ce85c19c-77d9-4d00-84f0-315b00e56b89", "comment": "Malware payload (Vidar)", "value": "8539aa7ff99cccd37fdb76a3b0367fb269101b5f7764c1fd9dfc4130d0dad9394061431fa42a4a2bbc7343d84bfd10b8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893483, "uuid": "188af978-ed9a-4eeb-ab58-c8c9d786a21c", "value": "T1E555E118AC3590DAFCD344706F769111E533BD3BCB246AEB51E49B111A4BEED0A3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893483, "uuid": "ace3f037-7979-4606-a5bc-7848eaa3ae47", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893483, "uuid": "34e9f1b1-5c00-4163-8a54-904e18949a51", "value": "24576:MUYxEL+Rbj/0c9qx6rFdmJYPlwR5NIER3Y0rnBrer9qinG:MUAE69t9qsFERDRDrcr9qIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756893483, "uuid": "122f676c-f412-4132-b2dc-50919061887b", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756893483, "uuid": "0f87582e-45b7-4b77-93ab-ff0e92fce26e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893483, "uuid": "4b75ac40-8c9e-4af2-b504-9eab438d8c1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cad952-8887-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756877421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756877421, "uuid": "5695c728-7aec-4c96-ac97-9e3ab9950895", "comment": "Malware payload", "value": "9a5289879140239767ecd6437f6ffd3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756877421, "uuid": "f8231ca7-3261-4b6e-9d1f-88788167e953", "comment": "Malware payload", "value": "60a876b5d80ad16d7069d8e40dde15e0dfdbcf1c1243efd288d2ce1d7c157000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756877421, "uuid": "de2a09af-0d2c-4b4f-a979-2b3a83d8922f", "comment": "Malware payload", "value": "bfbdc2693a67662e4dc4169ab07e9ab2884c8a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756877421, "uuid": "a35e85f2-23ab-481c-ab7d-688e62f6582b", "comment": "Malware payload", "value": "b9c915f716fd727994bc6b8304970c2009329758699a9662fec7217424b1ba1252fbe492466ea798beb89f9c16e3294a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756877421, "uuid": "0f0afc3c-148a-47e8-984f-470f5d8f4f02", "value": "T192256A2878BB90595477FF913DECB9EBDDDE2A636509681B1085030B8E12F80EE4793D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756877421, "uuid": "cb705673-d8e5-4585-9fcd-1f66015a1e59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756877421, "uuid": "86b74561-dfc6-41b5-ad6d-c83f14538a1c", "value": "12288:U7Fw9iTsykc+TLKxzb/TV9HFyuRwaQqz4HdEgrwyp6o32oPcfdJuazY4LjfeWyr6:cbjKQfxrmiBCBZ5DeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756877421, "uuid": "0b8a6e94-345c-4020-81d3-166c62b8e38a", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756877421, "uuid": "c431f9c2-4246-41f5-bf66-02afff6422a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756877421, "uuid": "93aa81f9-d975-494c-af58-798ff3519432", "value": "SecuriteInfo.com.Trojan.MulDrop32.29887.1349.16273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b66790-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894014, "uuid": "d3e7704c-01b1-4b00-a6f3-550e8b71a22b", "comment": "Malware payload (Mirai)", "value": "9de83e05dac6d543c660cc6c2ad5bc75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894014, "uuid": "7dc5bfb8-2346-4316-b9c6-02dbd975e6a5", "comment": "Malware payload (Mirai)", "value": "60d0f90c1dc37bc15ba4fe865540db83d5dd9a02e9e5f6d036e2a75f2303a43b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894014, "uuid": "d4679109-0079-4541-bf1f-09bd2b529854", "comment": "Malware payload (Mirai)", "value": "3554cbf50741eecac7e251095f0d140ae8744a1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894014, "uuid": "05e746b0-b0d8-4653-852a-96d23853e40d", "comment": "Malware payload (Mirai)", "value": "ed348d733ff49c97d2da0b4b4ba544d70f2588fd1414fe08655727bad4420ade3c233be092ebf9fc4b090d9c9a380337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894014, "uuid": "b6ad123c-74c5-4164-8bba-f969f6d5dd6b", "value": "T1B0C2E13062ED1CB5C6600532E7B856C9BA530F7DF6FE3890214147BF7942D0929DA9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894014, "uuid": "25633380-3878-4571-a23d-fccff58bd14c", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE95Dr3T9hymdGUop5f:ERsoTAZ3alkXLvFh8nNE95Dr3Rs3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894014, "uuid": "2f38abef-9f02-4aab-9e1a-fe37e430cd28", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894014, "uuid": "7a0d8916-3d70-442e-aa4b-546df2bbecc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894014, "uuid": "62408767-9fd8-43fa-b428-e83725f2ea6d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601c5590-88f2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756923502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923502, "uuid": "c410ff23-16fe-4ebb-b048-0dae0f70c9b5", "comment": "Malware payload", "value": "37cc31f5a9968dcfdf033e663a6344a3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923502, "uuid": "54c53b8d-a69d-494e-916c-011378bc276a", "comment": "Malware payload", "value": "612210b976d365bf251ff9b0660f346ecb1b913fb2a7d129e643e3f739d5b4aa", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923502, "uuid": "d2f25e9f-b5d0-4521-8d09-e4c4084ed129", "comment": "Malware payload", "value": "30985861213d3b5b2e1b94b01cea489c9d30131a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923502, "uuid": "6a8c41b1-5032-4e68-93c7-11a78d161be5", "comment": "Malware payload", "value": "48e29687f0e1e402a7a742fe4973e87aa581c3bff845eddcdba3d1d48e9d1ea0584152e9d47cc1066d3387dd063e7bac", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923502, "uuid": "845269bb-a4da-4503-a7b6-c75d8741a7e8", "value": "T18181404063F81364F3B77AFE5ABA21510CB678A7DD20CB4C1048490D1831E98CDB6F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923502, "uuid": "7d15c0aa-98de-42b3-8605-7c3b0ba4c4c4", "value": "96:8LqyeQbsJtCQjFnHIUS7ClBCgA8oepmsmS+XmTmVmSAPWmGAumL:8NeQbs3PFHvS78lj9pmsmSOmTmVmSVmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923502, "uuid": "2731a03b-fedb-4fcf-87cb-16c80e783e4c", "value": 3993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923502, "uuid": "80119dc3-6216-4659-8fbd-64781d3548d2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923502, "uuid": "29c5ed90-dfa9-458e-bd29-4e58ada04818", "value": "DANH_S\u00c1CH_BAO_CAO.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f45c92-88cf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756908426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756908426, "uuid": "d7953db5-5e98-4367-81fc-95f92332e812", "comment": "Malware payload (Mirai)", "value": "5d9bf140000bad8f1553f057cc9305e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756908426, "uuid": "fe41fa29-bba6-4903-8813-4f2aca99a9a2", "comment": "Malware payload (Mirai)", "value": "6172a52231c1e115addb5c6366950bb1e5ceb42d4ed44fed934bb6481833dc00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756908426, "uuid": "763a0c6e-62b7-4050-8328-9362c9ba58a6", "comment": "Malware payload (Mirai)", "value": "3004ffd92d135f25342324a9a58f9696d006031f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756908426, "uuid": "e8094c29-980c-4f5e-8c7a-38928cc473d6", "comment": "Malware payload (Mirai)", "value": "a6249b436fa864acd1249d1772d6cf323a233fe93ca9b9b277ffbdfdfaf4b90e5818dea5cf57856980ba4b2c19561a2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756908426, "uuid": "ea03b002-b89a-4f2a-9895-366c7349da8a", "value": "T1AC735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756908426, "uuid": "23e00e01-97de-4ff3-afd4-f845dbfe2a9a", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8G:YwfdNu4cmZvFqI3w7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756908426, "uuid": "a83b6932-3baf-42f8-a142-d32b5beb1216", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756908426, "uuid": "ad9a3db8-453d-4f0d-89bd-d256fbdef02d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756908426, "uuid": "50fdf663-4c12-4785-b0be-9f50079a10ff", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdcc536-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894054, "uuid": "934786fd-6d59-438f-a100-9a9cca8d1591", "comment": "Malware payload (Mirai)", "value": "020c1ed3e662d82ac5ff41789cfead6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894054, "uuid": "f692201d-0534-4af5-8c36-c31a84be714c", "comment": "Malware payload (Mirai)", "value": "61cb67338420d1cf0e5a5b6605f6b6d202023aa163a6452529920603e922996d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894054, "uuid": "0ba681e7-f6ac-429a-9245-b5a70ec8742d", "comment": "Malware payload (Mirai)", "value": "840e2a86b9f47d7042c9ecc32636157ead377c5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894054, "uuid": "b3330ba0-3624-4a0b-9bdc-e9383afcd1a4", "comment": "Malware payload (Mirai)", "value": "07035ace337406925b47a2ce5420181410003dd25988a7bf42ea8e1ceacc3e2d48c3a4153da7745f707eb4aad26c9529", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894054, "uuid": "075c2b75-ce97-426c-80fb-006d2c7dc2c2", "value": "T13E83D60ABB604EF7ECABDC3745EA1706209D552A30A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894054, "uuid": "b724c910-fd69-45f1-93aa-2e13946ea3eb", "value": "1536:W1XW3UTVavjqVQywbPxPP/wwb9lT2TiUeL6SZJizKzC:W1XW25VYnUjSGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894054, "uuid": "907cd04f-5002-4cca-b806-67ccca01d493", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894054, "uuid": "2e6df1f8-18f5-4571-941c-8a91d838c3ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894054, "uuid": "d596f4f6-0ecc-43d9-bbec-8edf8866b1be", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7377fdf1-88b0-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1756895188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895188, "uuid": "c18fc2ef-5071-4aa9-a8db-5865131f9738", "comment": "Malware payload (QuasarRAT)", "value": "269482e8787a04cdae9b3c76a5342b7f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895188, "uuid": "d6fda3c1-7edb-4348-9665-f544685bc5b9", "comment": "Malware payload (QuasarRAT)", "value": "61ec38741f1b45c5e797ab56bedc01f63fb089d1946f978a1ba735602e2cb455", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895188, "uuid": "73a3e4ac-1a47-4b6b-b22d-3f2488b1afe2", "comment": "Malware payload (QuasarRAT)", "value": "5df99c9fa08f25bb37b52cb8af6c3ba4653e108e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895188, "uuid": "055e2dd1-f5d5-414b-9342-bd50f39acc9a", "comment": "Malware payload (QuasarRAT)", "value": "681844e67e62be73d1eace61aeb764a95a3e9bba077a74a3083a87edf8aa7d7a16e829c2ff49f14137ba3ddb2d676469", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895188, "uuid": "3e5ea16e-e223-4679-8918-1bca709995fc", "value": "T12BF62AA611050A8FF1621DB4BC116EF5276CCC921ACDF607D219421F3790ACCA6FFB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895188, "uuid": "4f763a17-5bd9-4b97-b237-374dd2f540d0", "value": "96:YFYJhY0Qiiz6hqVXQtcguuztv962UuzUkMU9CsDaK+ohMTHO0Mgs0uk:YFyqWF4t3uzdw2RiUgsDX+o8HO0MgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756895188, "uuid": "fcda167a-ef67-4da3-9b66-57d8fde369b2", "value": 16782747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756895188, "uuid": "d7d4ede8-07f4-4a6c-a84d-1981bb396d0c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895188, "uuid": "ccfed996-d3ef-4610-8a31-573890161914", "value": "comer.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e748bb-88ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (Bitter)", "timestamp": 1756894229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894229, "uuid": "346e8f2d-8095-49a6-a07e-280036da465e", "comment": "Malware payload (Bitter)", "value": "fdaedfc467b38a0564423822eed8936e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894229, "uuid": "081401f0-6b91-49d5-bb44-ce72d9eaf864", "comment": "Malware payload (Bitter)", "value": "624decbc0445e51873436e42699323bf48093e0c4ba5ea1d348e9e5a1822579b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894229, "uuid": "2f0824a7-422c-4d6c-b3e3-90e14fc72454", "comment": "Malware payload (Bitter)", "value": "8d35de69fe048eb9ae2e7ae1b8bb8c931af76e2a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894229, "uuid": "e4d8e1db-d53d-41dc-8e3c-c748c5da1a48", "comment": "Malware payload (Bitter)", "value": "24e0f66ca24f3fe1a070202ceb5b100b58cf2cc0f5bfe06696933e6b3a51d9a5f0c0454c7026814aeb04086b5da599a9", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894229, "uuid": "dcb6487a-0eeb-42b2-96a1-e9c9f9c4dfdb", "value": "T128222930F6600610CA8C1B3A7F8B664F7116F9216BE54A0FB61A77289C75A0D6E909DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894229, "uuid": "a26f0c5c-ce27-415d-9aef-e97dadee3521", "value": "48:93Eg70c7QRlEFlErlElEo5sHf+hOc6p6L2zkmaHfM0lvjX3LKSgte3THH2EPyGyP:93BfhMc6p6Lsa/Me7XbGe3T2EPvyOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894229, "uuid": "c6773242-055c-4e45-9c6c-74da1ac1f76d", "value": 10719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894229, "uuid": "80671ef4-715e-413b-9d51-2f33d614c6cb", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894229, "uuid": "fb4a4d22-7f1f-4f81-ab93-b2e69bce11a8", "value": "attached PDF Document.pdf.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ee73d5-88b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756898658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898658, "uuid": "e84e20b2-b4fa-423b-82c4-f692840fffca", "comment": "Malware payload", "value": "88c0fbb7e79bcfd21f2da0e4bc5c796f", "object_relation": "md5", "Tag": [ { "name": "FIYAT-TEKLIFI", "colour": "#9A229A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SoupDealer", "colour": "#AF28C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898658, "uuid": "f1900e2e-bca3-45e5-a0cf-4bff6829ad2a", "comment": "Malware payload", "value": "62a301cafc9e007bf19b4f462557ba22091c621a15af98cd617c4299452e0814", "object_relation": "sha256", "Tag": [ { "name": "FIYAT-TEKLIFI", "colour": "#9A229A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SoupDealer", "colour": "#AF28C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898658, "uuid": "b4990967-5dbd-4658-90ea-50d51a02e798", "comment": "Malware payload", "value": "853752368c7b71156d5e9d251589752157fdd8aa", "object_relation": "sha1", "Tag": [ { "name": "FIYAT-TEKLIFI", "colour": "#9A229A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SoupDealer", "colour": "#AF28C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898658, "uuid": "b7a38f67-3f98-4f4f-bca1-526ece021cdd", "comment": "Malware payload", "value": "2c705d612bb5240322ec10acb42a1cb9c9a09da039be10d6a7da3763df123724433396d8821994b471bd854791062d53", "object_relation": "sha3-384", "Tag": [ { "name": "FIYAT-TEKLIFI", "colour": "#9A229A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SoupDealer", "colour": "#AF28C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898658, "uuid": "7707e8c7-5fd4-41e8-9ec6-fc8909218172", "value": "T16FE4232D1D885AA4B9DD2FB8F3E0D0E8516DD05468AD945F2DA000DB2CB7B8B2C1ADF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898658, "uuid": "7072e339-1725-4c27-8fdd-ad1126a5f588", "value": "12288:PN3Fk0GZ6bJWOfXJC9JIVC7yWV/cCP9FIPdYUmrrpjEPq7WtmKjoQdVv:PN3FoQ5C9/2C1FidhmreeWt3jXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756898658, "uuid": "0f1a81dc-319a-4c3a-ac2b-a7337763dfea", "value": 687124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756898658, "uuid": "f52e0a3d-0aed-4d79-921b-10e48cf50033", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898658, "uuid": "ecdf8e16-bdfc-44a0-9300-21f2944fee0b", "value": "03.09.25 F_YAT TALEB_M_Z.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367cf12e-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1756893797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893797, "uuid": "079046e8-5c8c-4b76-aae5-ead971a3a8b4", "comment": "Malware payload (PhantomStealer)", "value": "24e4d6993acba50fc3c1f29f47edd1ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893797, "uuid": "0a6e9322-0e92-41d1-b8ac-c9045a2e997e", "comment": "Malware payload (PhantomStealer)", "value": "63be0e987b9412c3e04e5f09a5b7d2cc05d1a7772d887c1e21ffac62287498cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893797, "uuid": "3d4594b6-515e-4ae3-b912-9c1e188fe2d5", "comment": "Malware payload (PhantomStealer)", "value": "769edf6252d763c4bac2e3ab2e1e80fde7fe403e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893797, "uuid": "fe39748b-ca28-4f92-beb7-17dab377bef8", "comment": "Malware payload (PhantomStealer)", "value": "a7a651137566faca8e01240d658a3f9f9426ec59ff527890e90d43ef18b6232375a290975707aa357a709d5fb13b82db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893797, "uuid": "4e820035-5460-40ff-9af5-6e4b5d378b0a", "value": "T1C683C707BA87C5B2C7C85B76D9A788001370D681F763D71A798E237A1C43BBE8A405DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893797, "uuid": "3d584afa-e494-4695-907a-98bbca0ff5f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893797, "uuid": "00ff696f-3d5a-4acb-ac54-1441c305dabb", "value": "1536:kjQwYS2BmcqpRp8FaiJj9i3BRdlzcJeW2OHBbymwu5ueZVHkeJVmlej:k9cqi59wPdlYN2Oty5uEHlej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756893797, "uuid": "04f1f095-d46a-4902-87ec-1e1806938d38", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756893797, "uuid": "d2092753-4220-48d3-9dcf-2be822b53549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893797, "uuid": "49421cfc-8a7a-42ac-8990-1fa1da5329fb", "value": "RFQ-BECRISA-PROJECT SPECIFICATIONS REQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4e7e5a-887b-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756872624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872624, "uuid": "4adc1bef-be2a-455b-9f86-e7cc11490c8b", "comment": "Malware payload (XWorm)", "value": "9b223035f3484b9b6aeaa2f45167bbca", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872624, "uuid": "7e6c302c-4599-49c2-ad75-b7041c98c0a6", "comment": "Malware payload (XWorm)", "value": "65cf34b295ed9f6c374c14b406762ca7b1f470bd3109d0137cb469137d2f06ac", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872624, "uuid": "4291ea7d-fbd1-4b05-a0f6-cec1698e6edb", "comment": "Malware payload (XWorm)", "value": "80a236674b41cd1036e905ebe86056b6ead71f15", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872624, "uuid": "1309ee57-0729-4909-a1ba-69acd20088cf", "comment": "Malware payload (XWorm)", "value": "b22a317614139ed86241f03ae3f41736f7978dea4350fbb6b3e6125273dec2a3b4e4d499f01756f31f2eee7786483eae", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872624, "uuid": "d3c69845-35a1-4b1d-aaaa-100e00d6ecac", "value": "T16704D53DC7F6FCD4036EB0E09A6D3B46205C5B93F6B61B2CF4C50AA90954646EB3A64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872624, "uuid": "cdb42e4f-28f1-400c-87eb-9ba5c8632741", "value": "3072:y4SUtlAuNlVRMYUgBi3H+EZdc03+C7+c4ClDmqaYbaLUGCYj9UPRLJnAaFvXty+:kUtlAuNlVRMYUgBiF4C9J81UPRLJAUlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872624, "uuid": "4dbe5dbc-eeb1-425f-9265-957b55e2a7c3", "value": 184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872624, "uuid": "0a41f4d3-263b-4dcb-a7ad-b0ef14c6b8ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872624, "uuid": "e5f7d569-30c9-45ab-8711-aaaa5d8bebbf", "value": "PO-64430209022025 ?? SAKITAIScan-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c4b6e7-88ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756894173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894173, "uuid": "3448ca16-3ab6-4dd9-8cfe-ac293a2f6f99", "comment": "Malware payload (RemcosRAT)", "value": "faee72ec4c626eaba586a04e891b3e27", "object_relation": "md5", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894173, "uuid": "48f05a75-c731-4548-99af-c352426cc7ed", "comment": "Malware payload (RemcosRAT)", "value": "6633c215d97f3b2e4c3026127c47b276ab104609bc564d2313d6ef5bebaee162", "object_relation": "sha256", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894173, "uuid": "9a409928-5359-422f-a6f3-e9ac5a23630a", "comment": "Malware payload (RemcosRAT)", "value": "68dde26b7a2d2da988cb999643c32e0076eac599", "object_relation": "sha1", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894173, "uuid": "38806889-375e-4e6b-8b0e-b0befaedeaca", "comment": "Malware payload (RemcosRAT)", "value": "611033912adc018234fbd57718abb859ef8643a5cc49247fe003dd1fd7a8e662b8827a63fcced7a013a299bfdc3b7a72", "object_relation": "sha3-384", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894173, "uuid": "f8cbfa78-1260-421f-a2e7-2c990da48ba7", "value": "T19BB2F180C0D7EE7DD95627825F916CE28E4CAF95D0F907F51969C2C2B1DC5A4F6008A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894173, "uuid": "249b50ff-ec9f-4873-bea1-528ad7bb67a4", "value": "768:D1OQ9M2Xxvq428zfRNANz+djWDJHqOVFPwTU:Dsdqj28zfTANz+ZWDJH5wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894173, "uuid": "c3c2e341-9c01-422f-b47a-5b19e2894f57", "value": 25027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894173, "uuid": "3baa7260-469c-41b4-9b11-2d48574f8ca6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894173, "uuid": "fb3ab4ad-4425-4cdb-92c2-2852e172f551", "value": "RFP 6008878171 IKS 3118219095.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50243afc-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866782, "uuid": "37268529-212b-4a0b-80a4-481047427212", "comment": "Malware payload (Mirai)", "value": "02fe78d42bbf328673ce9c65b8655e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866782, "uuid": "1cca29c8-775e-43bf-9dbb-5419820f612e", "comment": "Malware payload (Mirai)", "value": "66fc1d30ecc23f1b96bf957e929a109ce378f1902e9d059738c1081bb8b29dd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866782, "uuid": "34f9d7b0-6b4a-40ad-8570-e86c9066c980", "comment": "Malware payload (Mirai)", "value": "69fb7f9e614b43568772646bbbdd94a855dae0dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866782, "uuid": "d4741cf8-2627-4db4-a965-4275768bb510", "comment": "Malware payload (Mirai)", "value": "28abe32e73768ff03c376c545c4c9ca1543a0b4265369b6287e524365b4ec5e78419071f8f53cf2e1e612d2f81260c21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866782, "uuid": "63941abf-43a1-4217-a0be-7b9c062e3e17", "value": "T131230271880E9EF525303C36DBD5A7937AE02AB2C6673023DA280A3C6F757531E57E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866782, "uuid": "c343ac39-768c-4c84-adf9-13dace42e1a4", "value": "768:S/TYCoIxdEk+AxoTZAZHFeq8b3o9q3UELbUXfi6nVMQHI4vcGpv/:SECFd+A6YHAxRLRQZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866782, "uuid": "9d622d73-dd2c-480e-89a4-d6a34f891c39", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866782, "uuid": "2a4cfa4d-3e91-4450-8810-4d35879c5aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866782, "uuid": "ca6abe30-1524-4948-b30c-7cd9ef57c985", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b791ad-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866761, "uuid": "446edc6d-142f-46ce-8d5a-9920c10f6c09", "comment": "Malware payload (Mirai)", "value": "03da0d62d4ee555044ee99fea4270144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866761, "uuid": "b21121be-27ea-4f7f-8a9a-283212ed5297", "comment": "Malware payload (Mirai)", "value": "6744e970af57fbaea0025efe41ba0a3e72669734af1fdbd14c51cc4ed47688c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866761, "uuid": "494f9406-f05f-454b-a288-90428df87303", "comment": "Malware payload (Mirai)", "value": "0bda17c98c886b21e8bd7466d738f041ec238908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866761, "uuid": "764f6f07-daee-437c-ba56-59867c29a848", "comment": "Malware payload (Mirai)", "value": "c6fa11e2870b9a689ba96069e3e84188df1b509be8b84fd48c411b0791fc4467962512e31fc82e8134fd47b808a5bed1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866761, "uuid": "9afc4958-97a4-47e9-b172-d788aeec3bf8", "value": "T1C0B2D895B956C903CBD68272FF1F928837160748F1DA73039E263B76964BC270FBA644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866761, "uuid": "b1452314-0224-4dee-9ad9-43554b8069ef", "value": "384:fLiRGPdq4r+vBiAfG254juB222222neqdWtpTDP208q11/jrBlujJ8yFx4e:fGkdq4r+vIAf9eqdWtpXmkFlujJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866761, "uuid": "bb48b919-5cbe-4f30-964d-9fd5cb844d4a", "value": 25400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866761, "uuid": "c80f5576-a8b8-43e0-ab5a-5d1c4b064b71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866761, "uuid": "62b5d101-2af7-4d5d-af72-4a82a51a35d8", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd06fb2-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756872016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872016, "uuid": "fa8c9718-cf61-469b-867f-63a82c51ee7f", "comment": "Malware payload (LummaStealer)", "value": "1b8e3a467c3b6ac50c63a5f29749ae2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872016, "uuid": "030ec7a3-c9aa-4088-ace5-d08764580c23", "comment": "Malware payload (LummaStealer)", "value": "67e84e61aa5fe1a0946ae1df43475602bbecb658a8de14a5e83978cbcbc6b2a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872016, "uuid": "05481d10-6a85-4c5b-85f1-77abac11fea4", "comment": "Malware payload (LummaStealer)", "value": "80abb9a8fc50185293c1fc9ea7ca2f00acc9f5fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872016, "uuid": "8e0b2887-a166-443c-b183-2dd189e5f368", "comment": "Malware payload (LummaStealer)", "value": "bffae8c47f42d82a709df5efccd371326a8f90cd28da114aa6a0093547945fd980320e59cf7bab72638e47dfdcb0b30f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872016, "uuid": "70538062-06ee-407f-842d-d6c9cadcf064", "value": "T18D45D018AC7590DAFCD340706B769112E533BD3BCB242AEB51E497512A17EED0E3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872016, "uuid": "d2986535-b767-4e3d-ab91-89fca2bef7a8", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872016, "uuid": "a96959fd-78ef-475d-a7cb-035e68f5600c", "value": "24576:7UYxEL+Rbj/0c9qx6rFdmJYPCJlMhaUdzt2DRkBw9vxsyAi:7UAE69t9qsF40dztsGw9vVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872016, "uuid": "f52361cb-2fb3-40f4-9e7a-2c2b3718a1a0", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872016, "uuid": "c0b27cfe-0d47-426d-80eb-5dfc897e8a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872016, "uuid": "4f7e0695-422c-40f2-aa35-9e55b75435b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8afd51-890c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756934529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756934529, "uuid": "1cf82eff-217a-419f-b078-a86aaaaf6d9d", "comment": "Malware payload", "value": "a9cbd62b7e36feb82a2ca0442c2494d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756934529, "uuid": "35cc96df-9ac0-4b35-b928-9c295dd47bfe", "comment": "Malware payload", "value": "680dc01df2f5b2033de43a73b161c59fe1a64f6cc8af37510dd5af6d839efd8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756934529, "uuid": "86b824e0-1e24-471a-ba38-6be7ca524910", "comment": "Malware payload", "value": "fab02a09b346ad303ec13101c910e08d9879e3b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756934529, "uuid": "d86046ba-4c57-46f1-9167-c6092f4541be", "comment": "Malware payload", "value": "456b64524ee5997bfbe12a5631e0c4af953504687229b91042b0673f26e4f3fdc5d488f1f23f9b3b47a653c6ae061093", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756934529, "uuid": "0c5cc61c-285b-4545-8749-e543f324e38d", "value": "T19A5633F1AE038129C47F65B58930AFF8597C9CD88EA43AD353BC386D8A371C185365A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756934529, "uuid": "46d5b305-060c-493c-b0de-08fa194e1415", "value": "b6182fbe920df1aaf4d2d78709ace252", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756934529, "uuid": "439d336a-7f77-4723-a242-63f6ae359e8d", "value": "98304:saQ1F5wosWk51s+zR8tSvqdUMbXynm0WDEIQKsVv9XdtllH6bWoiXw/QyeozLckC:JHO+1INUMbinm0WDEIUVl/lIbPaw5L0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756934529, "uuid": "e893e103-1ed3-4208-9444-698ad4034faf", "value": 6168576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756934529, "uuid": "d36b186f-3dfb-40f9-87b6-a8092dfced2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756934529, "uuid": "09340f6e-efa6-4b9e-8662-7055254d2fae", "value": "uxtheme.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf04700-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756923255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923255, "uuid": "8ee6bd54-b35f-4fe7-84f2-0dea4132c479", "comment": "Malware payload", "value": "2035a3f1700643915809cc848b4b3982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923255, "uuid": "edcb27f2-7219-42b2-81d9-faf6b6f1364f", "comment": "Malware payload", "value": "6ac38594d51647d07dcaaa9a6b6bde035143ec8fbc6505ed1da9370452d7d9f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923255, "uuid": "119359d9-22c7-4f21-81b0-30c0aa01bdf5", "comment": "Malware payload", "value": "a39aa78c9bb43c9ea8eb6994af45e9b6fe20a4f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923255, "uuid": "f3cfd6f3-7144-42ca-8f66-3c35b1e76b29", "comment": "Malware payload", "value": "601c618ee6823805497f802fb5358779ad31573f644a41bccc7d60f1a1c37a9a93ad816d6fd5b1d97d750b72d7bf852c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923255, "uuid": "bd2d57c9-108b-47ad-ad98-a5f27ebd59eb", "value": "T14645D0189C7590DAFCD340706F76A112E533BD3BCF242AEB51E497512A16EEC0E3A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923255, "uuid": "98e826c8-f34b-4fdf-8c49-2430ceb63226", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923255, "uuid": "8fc79107-c7d5-455c-bb83-6da9d953138a", "value": "24576:qUYxEL+Rbj/0c9qx6rFdmJYPH79asQIOfdx:qUAE69t9qsFxEUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923255, "uuid": "a80c8be2-b085-47cc-9ed0-d4cd3be52c70", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923255, "uuid": "41551867-4aa8-4cc0-b9b9-a174bac73e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923255, "uuid": "fbbcc832-cc7e-432b-881d-6ed05547b3b3", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fba23b8-88f5-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756924817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756924817, "uuid": "55ed44a9-722f-4afb-a575-4d19c9b42ad7", "comment": "Malware payload (XWorm)", "value": "daba4e7e64ecbe2c88f3dfa3293e0a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756924817, "uuid": "ba26b87b-0242-4644-82df-727942eb3be4", "comment": "Malware payload (XWorm)", "value": "6aec274be9554ffe0676af41069f7f52a9af50ac7291de722203930aeca8a536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756924817, "uuid": "02983b95-cbbd-428a-bde8-6b270adafc0a", "comment": "Malware payload (XWorm)", "value": "f7b3571b5291153a701fc2bd377d909ba8a2baec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756924817, "uuid": "07720906-4377-4293-be62-4cf6a2fba8b7", "comment": "Malware payload (XWorm)", "value": "32e80e14e24849aa35dfefa00e74949c75652b24ebda12b63447e41f99433e31dae47e626807d5f3684262f73007e757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756924817, "uuid": "f1d859c0-ad02-4076-ac75-68d466703ad1", "value": "T1C2F25D083BA4822EC9FF2BF96973E6120371E5078A13EB4E58C4456A6F37B8149457D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756924817, "uuid": "ee236ab2-4a4b-46d2-8d86-855731734bc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756924817, "uuid": "c8ccbb50-ed43-4a36-87c5-4a5b2b8573f9", "value": "768:FzKeuw7mMDFDQAkOSSbvCyzC+5WDWVFq9J1OMhXulL:F9bDgOzdeHDGFq9J1OMFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756924817, "uuid": "843c8ec7-e889-4ea6-aed4-e983004a6153", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756924817, "uuid": "58ad1d4b-dd42-4116-ad1e-f8fe7ae97251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756924817, "uuid": "08cc5f71-694a-421b-bc4c-8643cfc44ab2", "value": "1756924025f0dcc2f1df01330f8ce9f437c4eef4d238e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7508c7c4-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929979, "uuid": "b7b92b4f-87b0-45b4-a411-9751ddfa25e9", "comment": "Malware payload (Mirai)", "value": "cb880023f4a957c186d563df4e1e0587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929979, "uuid": "94f6098b-04b6-4558-a5d3-dbdae5be3c47", "comment": "Malware payload (Mirai)", "value": "6b5631ffa982a3a5d67d4d1e2db34872651bb276884b6601541569276deb0a8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929979, "uuid": "6afb3786-40f0-44a4-8d8e-92aefa98e635", "comment": "Malware payload (Mirai)", "value": "e83c1fc7fa14bee476a9b36f9e30827016b74919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929979, "uuid": "d191ede9-fff1-41fa-8072-6921b732d297", "comment": "Malware payload (Mirai)", "value": "db889b4eb07cc505d4d13b3ab28466b99e45bc38b04434c4122fa176ca98577adcdff72af182ec4141eef2eac646df43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929979, "uuid": "795a6544-5936-4869-887d-caada2a88836", "value": "T1AC238EA7C43C7DD4D14992B8AD244A3C5B23E016A6933EF6B64785628047EECF60D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929979, "uuid": "041784aa-757b-4659-8db5-c2e67b296873", "value": "768:3/eptstaT85n1OCaxwtgN00y+qprKZP7GwQ9qB5m0jnCrACeoVJm1Ct6E:3/6s+YRaxwtg5uKie5TCcC/m1Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929979, "uuid": "aba0edf1-3faf-4e30-b836-3f2bb5de5098", "value": 47576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929979, "uuid": "21859f6b-24cc-4610-9f7d-5713ce8d3906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929979, "uuid": "404d9b4c-b43a-4d0b-b56f-383b6e57b14e", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0fa0be-886f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756867498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867498, "uuid": "5e136cf3-51de-4b38-a149-469622ef59b1", "comment": "Malware payload (Formbook)", "value": "83c059ad80bab0048fc247cdf9fd2eb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867498, "uuid": "0d7dbdee-f397-403f-b22c-1825ef5da8b6", "comment": "Malware payload (Formbook)", "value": "6b6662c1050599805c0a20155ca0c8fdb566858e1914e273a69f572a5e3e61ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867498, "uuid": "5bc00dfa-f360-4f46-b918-504935b87f14", "comment": "Malware payload (Formbook)", "value": "7f88c1d921474720044ee42627894d040d237cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867498, "uuid": "ce5a0f68-a777-4298-92c8-4ae1e1017742", "comment": "Malware payload (Formbook)", "value": "5d5190417974278a55c1452b924b949d742d63959ba187c22d58a2c8a221d45e3f907fc33abf56ae1a6418916ff1af88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867498, "uuid": "f262415e-f1c8-4eb1-9a6f-6c73907c668f", "value": "T14845BF0273D1C062FFAB95334B5AF6115BBC79260123A62F13981DB9BE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867498, "uuid": "85b62988-e5f0-43c9-b55f-2179cb6fee34", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867498, "uuid": "7f6b4c48-f3eb-49f8-b584-d4ff2a2b8c36", "value": "24576:s5EmXFtKaL4/oFe5T9yyXYfP1ijXdahfl69HHag2EarFQm4t:sPVt/LZeJbInQRahf+nagiRQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756867498, "uuid": "e9b3eee6-95ed-4c71-94cb-a2109ed9d21f", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756867498, "uuid": "4bf02bf3-e97e-46b9-a309-1860e119d1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867498, "uuid": "99014439-f60b-4460-a836-c378b18d0c78", "value": "PO#250198700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624ce561-8869-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756864665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756864665, "uuid": "1a8a5360-e6aa-40d2-8ed5-70e07535d3d7", "comment": "Malware payload (Mirai)", "value": "d43d3fd5cbf3ec485c4542afdb0268e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756864665, "uuid": "f3a347be-d209-406c-9a67-c65ae4c6b910", "comment": "Malware payload (Mirai)", "value": "6b895dd5abe5372171cb9571f6afb129c678559602d17730762cb86797a559a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756864665, "uuid": "2c2f6f64-dd05-482d-9c4b-bca76885ffd0", "comment": "Malware payload (Mirai)", "value": "44a43752f5071936df0284c4eb1781364c9ce61f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756864665, "uuid": "8df739d6-1ac2-4fa1-a37c-88e833ecfe46", "comment": "Malware payload (Mirai)", "value": "78e8e0e1fd975a09b75ce52121efd504ff4a5adda408163c8aa2055246bc042ce369c32e71a7824c587348f8d76a3b72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756864665, "uuid": "cbb443e2-cc14-42ad-a828-aaa75b595926", "value": "T1B4E30945BC519B16C6C662BBFB8E428D772A1768D3EE3103DD295F20378B96B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756864665, "uuid": "2c2502e5-f097-471e-8b9d-fca1be566d0c", "value": "3072:eDDWxW7r4WfPEpZ9DWuWW9SKdwHcHNoe6KAGyop+NcCVcJ:efWxW7r4WfPEp/W8kKdwHWNoe6KdyDNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756864665, "uuid": "161fb572-629b-4c1c-99b9-0ab43391bb8b", "value": 154360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756864665, "uuid": "58240236-955e-4caa-a036-9269a1148ded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756864665, "uuid": "1188d520-0af9-476c-9ded-7d851d300ee1", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b863338e-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894015, "uuid": "452566b6-0f12-4a7b-b9b3-76bbd94ba942", "comment": "Malware payload (Mirai)", "value": "ef3d1dfb484d5680dfa0aa8daaf96242", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894015, "uuid": "e5a6786b-0748-473e-8c0b-9fc28cf8bc65", "comment": "Malware payload (Mirai)", "value": "6d1d1df496a3ab3aa77e2536fc9fcb09ed3b6653b77c27e305aba647bc5f2193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894015, "uuid": "c3e6d9b5-aeb8-48f8-9e3d-17279c3daeb0", "comment": "Malware payload (Mirai)", "value": "8f66a32e2687c5968305129f7fcd8589a1086f16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894015, "uuid": "68853e88-67fa-4438-b03a-85b85392be9e", "comment": "Malware payload (Mirai)", "value": "d09069fe8443c485f614d14990510433d7e9bca6ee8e11df544700a0904ce6e2743cb7fff48ed51d2e94de12ef993915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894015, "uuid": "b0252e8d-b65f-4ca8-a0b8-5d1bcd88ab00", "value": "T1CE535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894015, "uuid": "0fb52dd3-f89b-4e0a-b782-90c9ed7711d6", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8Y:N1GjR8EVGOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894015, "uuid": "325d08ad-f954-42b7-b47d-4131ab4d17b8", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894015, "uuid": "7a1cdad9-317c-43de-8141-961ff010b115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894015, "uuid": "6a63e993-d84f-431e-bd2e-462f9c79b5ac", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c47c686-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929965, "uuid": "37f8e564-c876-4d77-8a6b-6837bc59782f", "comment": "Malware payload (Mirai)", "value": "1ea640191a40ab62a502490a781f1505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929965, "uuid": "d176d663-1997-4f92-9501-ead83dfd232a", "comment": "Malware payload (Mirai)", "value": "6efaeee90b203a14a7064a7793bb4740a98b5356cb4dd95a422f7f7687ec49a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929965, "uuid": "7c8c6333-c804-4995-b848-0fd98560e57a", "comment": "Malware payload (Mirai)", "value": "bf69fedd77ebe45fc4cd684e82dd225ad22c570b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929965, "uuid": "5918170b-7fdb-4507-b1fd-17e2289b6d20", "comment": "Malware payload (Mirai)", "value": "2ad5bf75d9c9975c4c66b0f7e4d92d22fe733701132ad81d7590918735d553b543fed4fc7bc9a8a4682b8211079539f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929965, "uuid": "424e8887-8de0-44a3-ab09-dc48e8a86b0b", "value": "T1E1332956BCD29A6AC5D423BAFA2E519E3321A3E8D1CF3217CC204B1477CA51E0D77B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929965, "uuid": "0a598220-4d6f-4e7d-bcb7-6ecb062c2034", "value": "1536:BRznFR4PmQmf40IBsjSPRD+mgLb6rL2yBCNt5s0W:/rX4Xmf40ywkvkbs0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929965, "uuid": "f4ec8f49-6933-4c4f-9283-75a80e3f0b38", "value": 53364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929965, "uuid": "95e0e82a-d049-4126-86d1-e93bb65fface", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929965, "uuid": "957d3947-0d88-42bb-ad4f-405d54d1a48e", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4319cb01-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866760, "uuid": "228592bb-00a6-4943-be0d-3832521b68f4", "comment": "Malware payload (Mirai)", "value": "c7bdd4b457c7b343c6dbc0a2665f80e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866760, "uuid": "13d6942b-75a4-4e05-ae25-c21db44025a9", "comment": "Malware payload (Mirai)", "value": "6f435eb2236d179a36333f714817b0e83c536600faf3a5559af200d25304df4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866760, "uuid": "9a3abc60-7b06-4abe-a36b-901c69d43ef8", "comment": "Malware payload (Mirai)", "value": "9cf1714f1efc3fc6380343f98697b7e9583042b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866760, "uuid": "e3f778e3-2358-468e-8b3a-d91d86b19dee", "comment": "Malware payload (Mirai)", "value": "7d111c5416936c7852aefd2eaa5d08c5f14568e6931317682df1fa91f5bedc58d6d751021b53010e2d0d1250575623b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866760, "uuid": "df37715c-7d1e-494a-9710-ec05f209d59b", "value": "T164F30845BC518F16C6C262BBFF4D428D772617A8D2EE3203DD256F64378B96A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866760, "uuid": "baefaffe-cda0-48ca-8901-d532cd4ddf5c", "value": "3072:1leW7LMPR7gvIcBLROSoSrsRNvHTl3wUe0leLgg5XMJ44NfM7E:1leW7LMPR7gvIAU0mpHTl3wULleLgghE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866760, "uuid": "92434db5-2fa5-4bdb-9bde-84faa9e0ed61", "value": 158456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866760, "uuid": "262ff030-aa84-464e-ad12-0a1018d3dce7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866760, "uuid": "72cafd2b-f3ad-4c94-9bb4-02445abc9c45", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c6c73a-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756891908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891908, "uuid": "a04fc6a6-bf3e-4acf-8d5b-070c0a9c6cc8", "comment": "Malware payload", "value": "5fa43bd2dc30af5bc35fdcf83273eb7d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891908, "uuid": "8324fef9-e775-44d4-8694-1cc750564750", "comment": "Malware payload", "value": "6f5670882b83421ad7ed4d3348c4389a4fded6f1625b42eabf9d671383055b0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891908, "uuid": "6443281e-3665-4e24-8156-6159d78d9bb7", "comment": "Malware payload", "value": "0e062fe22b81635569946738465b98385f530d4c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891908, "uuid": "603a7116-b38f-4a25-a0e3-9d22ee1787e7", "comment": "Malware payload", "value": "ed432b8f50537489f5fbaffe95f66b49e3bbc1bfa1957614cc77cc815a9aa9e616db78915a8c0f911638418ae65079a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891908, "uuid": "12f80c7e-903f-4fb2-b4dc-d8cfe2895d9f", "value": "T13B23E8F116CE09C02E9D643264F59FB8B69E01CA7A287ED21195EFA30DAD3BF151250F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891908, "uuid": "c0313728-b3d3-448d-b02b-dc360becb5be", "value": "96:zxSmELur7fUsu6QGtcZHTxvVnlIrj6yNHT0N0r:zAJLS7fUsu2taHdNafV1eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891908, "uuid": "87662027-c89a-4916-81a6-1f84144c5ffd", "value": 49871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891908, "uuid": "c6b4ef10-3725-42a6-b75e-44b8f8d0a576", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891908, "uuid": "a15b499d-3582-461c-8d9e-2879a202bdcf", "value": "ORDER NO.33385.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225635c3-88bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1756901494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901494, "uuid": "5e80f900-ddc9-447f-bf40-2693cb4f4ca2", "comment": "Malware payload (VIPKeylogger)", "value": "7baa5dde762eed51eeee6710cd077d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901494, "uuid": "1312f96a-f8bd-4de8-b454-0c052c145b77", "comment": "Malware payload (VIPKeylogger)", "value": "6f7729109b694aacc08e419e7126d1503ae2e77b5a6375e7299179309df7c562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901494, "uuid": "c93a20f8-8963-409c-af9c-3eb5a412696d", "comment": "Malware payload (VIPKeylogger)", "value": "160c379a748c704717f15a64f91194319cc1eba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901494, "uuid": "91d7bff0-0a45-47b2-bd58-00066e73a846", "comment": "Malware payload (VIPKeylogger)", "value": "241d57a04d0491c62716e1131b8f42391867bd1420b4fa136e979670535f596c3a2ea9ff292b6f01ee9b656c0e3bef6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901494, "uuid": "4a33736e-13ca-418b-8569-2746410b6329", "value": "T1CD5523027A54A771DF2B46317C1E5F2907927D7FA9E0629F2398B70E79F10B2879B120", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901494, "uuid": "9c7a9495-9270-4ed8-b65b-3291fdb6a103", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901494, "uuid": "c0e9112b-3504-4b79-9730-51b426418214", "value": "24576:I6GRbNQBM0agplUqQ/cRVR9fAULOC66v00sqI9RpE56VWOCDK5WO:Sbx0plUqQ/cRVRapP6psVbW54CWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901494, "uuid": "e3c293ab-e981-4134-bd1a-6fe1351a36d5", "value": 1292368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901494, "uuid": "67e18941-c47a-4a7a-8168-6afff2ecf10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901494, "uuid": "a7650566-e23b-4c0f-9375-5ef3df044780", "value": "Yurtd\u0131\u015f\u0131 i\u015flem ref-000000150950-ISB5163 (3400866200).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fea110-88bc-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1756900210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900210, "uuid": "79d8f778-d77a-4c9c-82fe-8e3e9fb98482", "comment": "Malware payload (MassLogger)", "value": "2ccb858aa9f1f1e8bb7ec02e44759acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900210, "uuid": "f7e0cb90-7bff-4336-a36e-519285ceb528", "comment": "Malware payload (MassLogger)", "value": "70ffcccdedd4cbfce9d10e4bf42f9917f33c055ba2078b76976827f3d604ccfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900210, "uuid": "b4ee0d1c-6870-48d6-a18a-91a4ca0b8d64", "comment": "Malware payload (MassLogger)", "value": "95995b99cf475193c891adb4ce34e882df614f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900210, "uuid": "5df5fb71-9bd4-400a-9f20-bf2c0d7035a7", "comment": "Malware payload (MassLogger)", "value": "92fa550d9953ac95ddb7639d55a73618f9a965be48c19ba6f1f137057abb608fa953556771be76a5febb885783bdbfe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900210, "uuid": "61c31269-e42c-4696-90c6-3455b1124c9f", "value": "T1BEF4CFAC3251B5DFC893C9328DA4DD74AA207DBA530BD20394D71DABB90E996DF101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900210, "uuid": "f82ad45f-9785-4252-9356-d27623785bd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900210, "uuid": "c33b0685-2397-471a-9b97-d13f30cec320", "value": "24576:smZoN+WIo10uyC8JK1NWGRCTfU6GT9Ge:kv1wJK1jF6s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756900210, "uuid": "63c6f163-09e4-4bbb-8def-c4e51bf5490a", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756900210, "uuid": "27be3426-800a-4388-95b8-778568b59e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900210, "uuid": "1d6fe8c0-2256-4be4-8cae-73a53540c8b9", "value": "SecuriteInfo.com.Win32.MalwareX-gen.77598143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12a65bf-8872-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756868689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868689, "uuid": "9a9c7d77-1447-434e-9edb-631e18ab0d77", "comment": "Malware payload (Mirai)", "value": "c85c43970db18488848e41e8b36e4584", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868689, "uuid": "c4cf97d2-05f1-4639-b71c-2e67770340f0", "comment": "Malware payload (Mirai)", "value": "73c92b147eb65f1d55ae1408d21e8bf6fa2356468fc6ffb5b8a5bc7d569d12c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868689, "uuid": "9f71b193-dfb8-4611-8e93-f8f50f9a6d07", "comment": "Malware payload (Mirai)", "value": "e1099fe9db7651c394bd739cd462aa9af0aafcc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868689, "uuid": "063385d3-0ae2-4281-9015-d460cc6327a4", "comment": "Malware payload (Mirai)", "value": "46987647e2d10352455514d159eb73ab4a59818f79b2c8df0fd39c933475de1eaab61bf34c0b2a649397d32be93dbdd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868689, "uuid": "dac16456-9485-4e4d-96ad-1a989146e49e", "value": "T1D1632C8AFD91CA16C5D952BBF61E82DD372513E8D2DE3303DE146F65378A82B0D2B640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868689, "uuid": "871f5275-9bdf-4cda-80f9-c4c85f7fc7d5", "value": "1536:BDOJeD7SCPn/f/86P/NjwTKR00IoKfPnNm0sT:BDOJu7SGX/86P/N+AIooPnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868689, "uuid": "e64c39f9-6acc-4915-a2f2-a3ef5f7b28cd", "value": 67636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868689, "uuid": "a5efe6c3-d4b9-4ab8-982e-1f19d7312d49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868689, "uuid": "ca0ae3e1-045b-4987-a4cb-cb4f736b1de0", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ad93e7-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872881, "uuid": "34a13b2b-738c-4a43-a674-293390d9c1cd", "comment": "Malware payload (Mirai)", "value": "28e3064707a175c3a49d5049909f52d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872881, "uuid": "81107907-f866-4c02-b8e1-ebfeb9f0ed4e", "comment": "Malware payload (Mirai)", "value": "73f2a13701f80cd36b15cb14931af1589822cc0240d595ce70cdc30947207e91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872881, "uuid": "01cd7d7a-27b3-4a8e-b4a4-a5efd9bc2750", "comment": "Malware payload (Mirai)", "value": "d410b0af743b1eb41968a748b620c584879ca796", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872881, "uuid": "f349614a-1717-48b9-9f2b-3ad6f54825cf", "comment": "Malware payload (Mirai)", "value": "42460dc0fb72b503af81fb6b5d1a53c7e5e77850621f81e16659a375ea0870d6d20b893a2e19e03bca67fda863bb2b6e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872881, "uuid": "f7a8b5d9-6fb0-4457-95ac-a9cbbef5a942", "value": "T1B731AFC6A2A109797E94D89BB66FCE4D300B75ED18C68F4968CC74F7648CD41B040793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872881, "uuid": "3bda3b0d-55e5-47aa-878c-414921bc1148", "value": "24:sF+DmvKsFksQUAbGHstDmmsLhIsAwR+xstBKsHolse2In:eY88jbZmJhAc+QBFobN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872881, "uuid": "12576630-324e-4142-90d4-71d05b9fd74b", "value": 1549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872881, "uuid": "b4e599bb-1a33-438b-b6df-f0d4d9630b83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872881, "uuid": "239fc8ca-4e74-406b-8f8c-e52802e5d014", "value": "aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9992c3d8-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913290, "uuid": "ca046587-748c-4ffc-9208-c85a90963dbd", "comment": "Malware payload (Mirai)", "value": "52f28e03bc865781d8fd9cb88c04549a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913290, "uuid": "0d005749-9eb8-45c8-ab54-c4e50e12ecf5", "comment": "Malware payload (Mirai)", "value": "7458e03e496aaad57bfa71c492e95d144065572172e0afbec1ac0c56b07207c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913290, "uuid": "fac1e090-866c-4a7f-bb1f-017d308450d4", "comment": "Malware payload (Mirai)", "value": "5a15ddac1f2266b2f97301f591381e3cae21c572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913290, "uuid": "52505d72-2c12-442d-a19c-b021a68ac5e9", "comment": "Malware payload (Mirai)", "value": "88fe695cf8252597f75931a93419356ce475623b0b94b3b391d80652ddadb8230007d55944c052a24ed6c7658b18b06f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913290, "uuid": "425822f9-5777-4d91-9a9f-3a4ef28b73f9", "value": "T1A2330A9AB8029D3CF90FE6BE54164E0DB93177C152830B2767BBFD936C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913290, "uuid": "ee9d5644-5aa5-48ae-a627-873a8f9af031", "value": "768:oBCP9hTzoEWRcqOCLuYU42e+Tm806Msq3zkHQXOZrupiQG0:TX5qCY/2eqm806M9kHQX0rui0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913290, "uuid": "faaf7043-86f4-471e-8d5e-17780edf0bb5", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913290, "uuid": "115ddffd-a2c3-4206-98ce-b69f0c1d1726", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913290, "uuid": "66de51ac-4e2a-4eef-a0d4-8d0ea567f951", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4841daa2-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866768, "uuid": "1a4a2f1d-00ed-49e7-b641-e9fe9f17b044", "comment": "Malware payload (Mirai)", "value": "11454961b147d3e4788052f5bf6fb59e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866768, "uuid": "4caf5ae7-a3f9-4a4c-950e-13d717233a91", "comment": "Malware payload (Mirai)", "value": "7478c5fd00c57f85130a917d30b627226b4b2e4738cf8a77723194e22ae66ce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866768, "uuid": "2dbf85a7-3994-42dd-93a1-2ade533e2cba", "comment": "Malware payload (Mirai)", "value": "a17ace336de465fdcc80bf29224e9e19a630f606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866768, "uuid": "8b47d0de-0f46-4963-96bb-5679b8ae2bfd", "comment": "Malware payload (Mirai)", "value": "7cb8a83eff2f3542c5f318c6c4b82a5c1357af87d411393af8a773c4f5e5436f95d6cfbfae616f0d911f3c7b7d686cfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866768, "uuid": "309cf5b7-a878-48d3-90be-aec64a60b781", "value": "T11BB2D03C1B111B98DA1EC0BD83AC1B603CB81B3591829D4B6217FDD7AF968787453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866768, "uuid": "8fc7adf1-5211-483d-94cb-d1c778d5aa6b", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui2mdzJgGlzDpH7uNj1JA4x:neD8ZSWvZHZbs1row697qohQvg92izJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866768, "uuid": "1d47fe36-9959-477f-8f0c-b6536dda59e0", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866768, "uuid": "ff3bb3c5-bac8-4a1a-aff4-7bbdf0ed760c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866768, "uuid": "da49611b-aa87-4aaa-9234-afec85b4c736", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad6d6b2-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Xorbot)", "timestamp": 1756929989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929989, "uuid": "2e555c0e-67f7-494f-9ac2-d8ef0546b37e", "comment": "Malware payload (Xorbot)", "value": "dc5b64e420dda1e98e37eb1d4891b8df", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929989, "uuid": "8a2ac0fd-2cd7-42bd-814e-393be47d206f", "comment": "Malware payload (Xorbot)", "value": "751d5b128653b4b72069e2907b77c7f0fa6b31bc468e039fb5a625feb5a96707", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929989, "uuid": "fb588d9f-8840-47e0-9d8e-3894607f003a", "comment": "Malware payload (Xorbot)", "value": "8efb312971953532f87d04a73d71e0a495c53035", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929989, "uuid": "f51b7bdc-31ca-4171-b517-4fbd76002285", "comment": "Malware payload (Xorbot)", "value": "34352a8827a0d1ef2be7b9a2b5cd6b53a625dc321036828da5a78f53bfab07835917939fd7ac4a66f41fa7918e7ab514", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929989, "uuid": "f7bfa8fd-6d8e-4119-acdf-f739c651d8d4", "value": "T1D222EFC8E5E822255E8FDE9575B01644F2745187B9C21F30C6EA2CF6C6CBF89720BB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929989, "uuid": "9a631e0f-8b4a-4414-bddf-d58920b6498d", "value": "192:pUsY8Y7r8pFHl8YnLej7cnLej7B7+7r8pFA:pUsY8baYnLej7cnLej7d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929989, "uuid": "69f1a206-e691-4c2c-8668-23f55ae295ce", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929989, "uuid": "8b0f2787-4050-4fbf-966c-20dce4c0d6f2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929989, "uuid": "dcba28bd-7a40-4b7a-8ed0-1831127cec3d", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b8499b-88a1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756888965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888965, "uuid": "ee1b98eb-a9ac-4fe1-a146-b9d9f4ce1201", "comment": "Malware payload", "value": "d75750be8142d101f891a92746afd803", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888965, "uuid": "4ca92bd2-2dc0-4f2b-8185-b0b8d9e93e60", "comment": "Malware payload", "value": "778b27d0fdbf433472461553f3b0ae108551502b646a15bf4b066c6b60947ede", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888965, "uuid": "090c8d33-cc46-4f05-b19e-c8cf14580985", "comment": "Malware payload", "value": "06b0e92c5b571936ed65b26565581c68bcbadd58", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888965, "uuid": "869d96f3-ffc3-43e6-8c7c-fc1030ff7dd1", "comment": "Malware payload", "value": "23466ef3b1eb2e1495387cc7badfaafc88e584c1774f2323968aa2f885fa45791fc0e75d3e1c3cf5879fd963fddbbd6c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888965, "uuid": "b23f8d96-7a23-4111-af52-f7c785a0067a", "value": "T1CCF62273BF8A8CA7D6D5A772C6BD2509008AEE65160EB8C3BF51B33D5F3B0D51608990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888965, "uuid": "3788f4fd-f7e9-4d63-b43b-a8a5abbc94f1", "value": "196608:84JfpBk4z5Z3RNWFQl9b72OPDOTgU4jg1nwLbycfpQDGaRQ6Z0K+dMECXQoMFhr5:V84bX1T7hLOLDZwJxa2TeECg15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756888965, "uuid": "7e65ab51-0670-4874-bf12-572aa2139fe4", "value": 15987844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756888965, "uuid": "3492d291-3441-4ae3-bfac-8883547e3834", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888965, "uuid": "80e1b2d3-28a4-4fbc-9f45-0ca35cd9a801", "value": "\u041dDFC \u0412A\u039d\u041a.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20ec5b7-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876019, "uuid": "da27677d-efc2-47cd-94bb-e1b867ef7e20", "comment": "Malware payload", "value": "0b4707b63d24de9e142a135dbc54b136", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876019, "uuid": "3ec84de9-4822-4754-b764-308f9722b22b", "comment": "Malware payload", "value": "78d890fe84aa329b7622f06e998f107cc8bf7d4dba42473faa1a2a07b6abfd61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876019, "uuid": "02539d77-6a9f-4b17-a91a-e8e9499fdfa3", "comment": "Malware payload", "value": "48f517b9325537e1b5214ab4d4ed4d272c6dd722", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876019, "uuid": "2095f7fc-496e-4b99-9554-6cfc60abb557", "comment": "Malware payload", "value": "106c5eb7c8f4f246ddc926f57e35bf4ca482e6a0e42feee43b0984c79de7da294aa4675eccb85788879358de07f90446", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876019, "uuid": "a45840d2-e467-41ac-bdb7-8d2c7af04eb2", "value": "T12E51984E916137D24F30AF9C727A4C44801C96543CEF2D89FB6D9AEF1A1298770A7D0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876019, "uuid": "342528b6-eb28-421d-8056-b6b313244837", "value": "24:S/0LFARLRgZWpVUHUM9npUG8gaIjIko0CWpuwKj7QjE5pTEEXMzU8yJLxLevI+bj:SMxCL+7B9npfv/oHMfI13gSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876019, "uuid": "84a993a5-91aa-4fb9-9bbf-3a1d0611a9e9", "value": 2991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876019, "uuid": "634b9a71-fa83-4a8b-a5e2-a223760ec72f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876019, "uuid": "d0097bb8-054e-4f32-8f47-a85f7d12a629", "value": "download-55_new.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811566a8-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872877, "uuid": "872306d7-f2c9-4804-90e3-c542b89573fa", "comment": "Malware payload (Mirai)", "value": "66696449e551f4a3371385b4d6ac9457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872877, "uuid": "3d8599a6-d07a-407e-b6fd-9171a5d22673", "comment": "Malware payload (Mirai)", "value": "7975bd89b73daedef0bd22cf2e1cb0051beabbcc05d7ec96a7e6ca6152806ebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872877, "uuid": "c48d3fba-eae6-4ac9-a846-9e0e7dffded9", "comment": "Malware payload (Mirai)", "value": "1c72c65f6208fcf23fed514c2cb6b6653102f58a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872877, "uuid": "537f1b6f-287b-4437-87a7-9dbb6e4c1d0e", "comment": "Malware payload (Mirai)", "value": "906ee1d13f335b96a400de0049b00f92191cf6cec1525d4f352fb7ef9e20269b44258d0d6c706d98e24484a13607cc91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872877, "uuid": "0247c88d-ec97-49e0-91e0-04a456571014", "value": "T166533D8AFD91CA16C8D9527BFA5E42DD372653E4D2DE3303DE14AF25378A82B0D2B510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872877, "uuid": "2fa0ee1b-7c21-455e-9519-15db33a8c212", "value": "1536:ozeKysPfc6nRtkOH06DZ417TKf8nNm0sT:oze+PU6TkOHnK17To8nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872877, "uuid": "e45c5a68-2cec-4c71-b98b-609d7a3d73ed", "value": 63004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872877, "uuid": "e8197146-427d-46a0-a7da-3ebe48326fcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872877, "uuid": "3067aae8-b276-433b-b710-a3f6d0a3a4c7", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19fbdea-88be-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1756901359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901359, "uuid": "a9cc3165-aebb-4dd4-a49e-61a880814ab9", "comment": "Malware payload (MassLogger)", "value": "c5a4817fbc977882ef72edaa36b2b8ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901359, "uuid": "19c9eb89-b608-4309-b89c-b6891b82238a", "comment": "Malware payload (MassLogger)", "value": "79c71f25fff4d08dcf993dce4624521a89b5af9444daa4e2670fa729179ffa46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901359, "uuid": "64293658-5a10-438c-8bd4-a1d2510bad93", "comment": "Malware payload (MassLogger)", "value": "af10f7d7b020c5b8efdc70403d4a413ead2da0c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901359, "uuid": "377a13b1-4abe-4e59-983f-468e0404e3f6", "comment": "Malware payload (MassLogger)", "value": "f01c9ae5b92cd2d507b4c4e9a866c60c761029be0a0f8bee2c7fdd9e6c4e4f7d4a2a523e44430b5a48367eb99249f21d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901359, "uuid": "dab56bc7-ce3e-4e00-b5a8-e4f88f77bb02", "value": "T1E9B63970C39191A1D297C870CE964FF965E1787F80365D0E16C4F81A25FEF21AF9E2A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901359, "uuid": "a12aad65-cbcd-4206-a22e-7162e7f69ef5", "value": "43df39ca45e2ff5f9a4ed4a1c7fbc6f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901359, "uuid": "733c60e4-87cd-421b-a293-a614319d8cfe", "value": "98304:X76A4KnYoE6OPz7WTMG5f7BI5ShRywWVPcdc:LGKni6u8MGDnRywW6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901359, "uuid": "3542bb93-96bb-4657-8469-fbec90df868c", "value": 10968126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901359, "uuid": "18f0564a-c785-48ce-a46e-85551c8717b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901359, "uuid": "24771299-0e1c-4bbd-92fb-0a33f47f0007", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40edf77-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894008, "uuid": "8e0c326b-6cec-4e66-9c12-a2c40df10048", "comment": "Malware payload (Mirai)", "value": "38649967664077a35f41fb372f2da640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894008, "uuid": "9eb42691-0347-4fdd-95d3-332b14a068ad", "comment": "Malware payload (Mirai)", "value": "7a0d000d79bc1be7a41fa59d1892995ff61815d4dbeb49f6d7053da7034a1598", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894008, "uuid": "47809ff3-078f-4319-9cbc-4c4b1a4b13c4", "comment": "Malware payload (Mirai)", "value": "4f7abe25e01797a369c265ed83b425d00cbf8d11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894008, "uuid": "e23a422c-0b74-4333-b220-902fd1ecef8d", "comment": "Malware payload (Mirai)", "value": "bc97e325f1403129ced01c22031a3803780d57ac0bf44c8583afc6dc118f7e40e64448a0302a72b81b387cbbf7e2ccfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894008, "uuid": "0705cc38-373f-4b16-96ae-d0d7e72cd77b", "value": "T1943302726B6E29E291B05777BC33AC1AA69C13B85C6730DB2CF0661977C18064FF1682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894008, "uuid": "9d89a0b7-69bb-444c-bea0-ccda9001bd0b", "value": "1536:69O/ZMAXIxNUk07JwLcPqF1aBexo4opKZbT:69O/ZNKy/CLGqFUFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894008, "uuid": "ee2f6ee3-a215-43c8-a7eb-fc3976febafb", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894008, "uuid": "08098eeb-5a8b-4711-80b8-70ab4092192b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894008, "uuid": "50505e71-85de-4e08-825f-a5ad05f4c4ca", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4f0bc9-88c6-11f0-91c6-42010a9c0006", "comment": "Malware payload (PurpleFox)", "timestamp": 1756904655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756904655, "uuid": "44da77b4-27b3-4cd1-acb8-fbc7f63ffe49", "comment": "Malware payload (PurpleFox)", "value": "ac5e84d3488b8d9bafc95316d8a2efaf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756904655, "uuid": "4c43397d-cf8c-4a0a-ba1f-d8151a97e895", "comment": "Malware payload (PurpleFox)", "value": "7a4bd378812093cf8aa2a3add92477ab4a0647b9e7c3d098560c982cfd971564", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756904655, "uuid": "d3392f70-4c79-4aa8-9bd8-ee7846f28299", "comment": "Malware payload (PurpleFox)", "value": "dacf6c6102139944d23f891db2131ea462dddbf6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756904655, "uuid": "546de1eb-26ab-4a7c-a97a-dac5c325967b", "comment": "Malware payload (PurpleFox)", "value": "1ded98386695c064955ca763fe392c3ce5b8c54bddde744f5d3b089aaa9ef5db618da7ae563930aeada9bdaf93a3203d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756904655, "uuid": "91313982-b291-4e37-a783-0c889f825ba6", "value": "T1D9861221B687C432C56D0177E969FE5E1979FE73073101EBB7E8396E88B09C16379A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756904655, "uuid": "f2959c4e-38f2-4cfd-88bc-cf1e6af145b1", "value": "196608:LbgmAwwSg6Ga9SEMXgNmhfjQGYznzasbbBko7AAdJOAV:LEmAmfgVqmVMGYznzasbbsAHOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756904655, "uuid": "f8d803fe-60c4-4160-9448-24c01a1ca317", "value": 8484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756904655, "uuid": "98bedd69-2d5f-4fc9-bb47-85caa44fb335", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756904655, "uuid": "6c35946f-86b1-49fd-bef8-9f75a787bcbc", "value": "Chrom-17027.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9646bb-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756891905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891905, "uuid": "4de489d0-6bf8-4001-97d2-e176ea656185", "comment": "Malware payload (Formbook)", "value": "93371db8b879cb30cea72ad6f730ae4e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891905, "uuid": "f52fa205-f732-41a4-9bd1-79e2be0eb123", "comment": "Malware payload (Formbook)", "value": "7a658b78a272da2cd15c18d7303bcad4c7063d1741a2025a63eabc7d01117128", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891905, "uuid": "35858ccc-97a8-4e0c-a487-98ed8e7418a7", "comment": "Malware payload (Formbook)", "value": "619134f477a8d72bbf40e79337765d8fc04eae53", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891905, "uuid": "43cf8ed4-c0dc-426c-863e-fa8fa3d565ce", "comment": "Malware payload (Formbook)", "value": "e446cc2e5fdb56d796e2d8938bdfd1b0107a514fcd8f9b00cfb93cb203457c9c05008bfed1f27873e74655b90744d47f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891905, "uuid": "d68aaa3f-67d5-4c09-a9b6-b774379abaa8", "value": "T18163D22663AF5208B1F7578D866B12390BBB3E56053D815E05DCB60A8FF3A048C967F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891905, "uuid": "fc4c3dd5-923e-47d6-a0de-bbb11751616e", "value": "768:axNW21FjD+t9GmlJRRlFJFJFJFJFJFJFJFJFJFJFSRRRRRRRRRRRRRRRRROENwpV:8Ns4CvFDqSSSSStSSSSSSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891905, "uuid": "288041aa-e1dd-4e78-9cb7-2d997517e9d8", "value": 69984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891905, "uuid": "069f7667-7efe-428b-be26-77f672d99e02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891905, "uuid": "cd69b447-129e-4849-b5a9-58c6016a9c8c", "value": "Ordine Rif 25991117719381122.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209c3595-88a7-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756891183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891183, "uuid": "5cf2d7a8-89e1-493b-8175-b4a76fa5d7b1", "comment": "Malware payload (LummaStealer)", "value": "70f83aa74a82be2f0e2fafc9daaef8ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891183, "uuid": "ad670848-5a1a-4ef0-a339-d995a12ff77c", "comment": "Malware payload (LummaStealer)", "value": "7a96989dad3e9c90ef7dd009289c8f5f1ba830e42e24f75e6f0c4ea8f813894d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891183, "uuid": "3be76ef4-5f16-4f9e-a1fe-e8c116181116", "comment": "Malware payload (LummaStealer)", "value": "75df000be59fa966c448fefe56e1d908b8ac163a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891183, "uuid": "773f165c-f2ab-43b4-8e49-027e58071156", "comment": "Malware payload (LummaStealer)", "value": "7b0faf7e92388c3da291b08dfa5fc60af7f5101de6d6fe35a242d72262aa6567dc855bb4b176c0ecb52ea214733285ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891183, "uuid": "e802421c-d75a-4fee-a796-6e806b76fa33", "value": "T1C795AE5197F320B8FBF30F30783A667A5E397DC25C119CAEC190A96D0562E209D76B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891183, "uuid": "ae4557cd-47c2-4f31-a838-1a96e1d4b26c", "value": "3c9ed1bacd930c37be812d1f382b945f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891183, "uuid": "e0d5a8fc-e6cb-4a42-93d3-f56e1516f796", "value": "49152:t8XlIxLV5d3MTkmT6vRTQrkJECqjfUuNm48a/:t8XlIRVb3MTkmT6tYCqjfUOm48a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891183, "uuid": "79ef99e9-8494-4514-bd1b-abbedfd5cde3", "value": 1903616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891183, "uuid": "8889a53f-707c-49ac-8b8f-7979038ddff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891183, "uuid": "5690b711-3892-4e08-8fce-ba83ae32f60d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.31191248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc71ed2-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1756891876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891876, "uuid": "3fade243-3628-45b1-b5d9-2e5e2fa87363", "comment": "Malware payload (SnakeKeylogger)", "value": "e61ebf001df3a0ad9c75c590418c76a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891876, "uuid": "722e3b50-60cd-40c2-b07f-c17b9b058c77", "comment": "Malware payload (SnakeKeylogger)", "value": "7c15d5c57a85cbb55dec53514a8b0ce1e055bc5f49fb9feb2fa307d6a43f36c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891876, "uuid": "d5680401-ce12-47d6-b07c-0d51904f7493", "comment": "Malware payload (SnakeKeylogger)", "value": "bb303fa8d1be1269b492a1650f7d678d3c078c15", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891876, "uuid": "c003b81e-a09a-4bd2-8fa5-c494d2d3e284", "comment": "Malware payload (SnakeKeylogger)", "value": "6a25b087681b18cc50bedb60fb85137c2903edd85dd7c896648910eb45f5b0f82285e2bab913939bb56dfb79eea6fbbc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891876, "uuid": "b49bf46c-3d71-4960-b9cc-214a04a6bc22", "value": "T15214093CC6B1FDC8073E70E0A22D3F16205C0B93F5319B6CA4C51ABA1D65699AF7A64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891876, "uuid": "4bcbe846-4b3e-4848-a3ad-0e764f74dac3", "value": "3072:YSGslAuNlVRMYUgBiGTCrp4QhoMfxcgdSaut2a7isiStBTU0RwBCGr+0:llAuNlVRMYUgBiGGLj6gdSVNGsJtBgGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891876, "uuid": "4e15264c-181c-4ae4-82f3-b5c1abf2e0b4", "value": 196659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891876, "uuid": "5fca2102-9dd1-40fb-879f-bf533e696144", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891876, "uuid": "14eda1e1-302c-4961-ac49-edbd5216e992", "value": "swift_02364.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b382ba1c-8875-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1756869955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869955, "uuid": "0dc4b290-11c7-4c3a-987d-c7fb94c4b612", "comment": "Malware payload (AsyncRAT)", "value": "88123607e768c3b83f83113babc0dbef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869955, "uuid": "752d1efe-6fd8-434b-8c33-37ae42ec35c9", "comment": "Malware payload (AsyncRAT)", "value": "7c8c576731dd13174bd9289726bc59c98fa0db27515da65d5f3434c5c2921d02", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869955, "uuid": "c312d1b4-ae08-4f5a-b8e3-8c3e005dbdfd", "comment": "Malware payload (AsyncRAT)", "value": "1f0c69a26b1671def02e494b77d2393c4f3c812a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869955, "uuid": "e07fb7d9-cebe-4b5e-bcbd-b3121615ec1d", "comment": "Malware payload (AsyncRAT)", "value": "6902ec001bc855c01f2db8dfbe5a410b7eb3ae04e5a3f7fd05032b97a16211b10af34479f8ef04124e2bc3cc7cff9023", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869955, "uuid": "0053da64-897b-425b-8898-4fba262cee72", "value": "T13C232B003BED822BF27E4F7459F32156857AF2632A03D65E1CC441975B23FC69A426EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869955, "uuid": "48cad751-536f-4cf3-8f2e-1fca4d520598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869955, "uuid": "82ba71c0-8bfd-4f44-b968-2204b33f0a61", "value": "768:wu/dRTUo0HQbWUnmjSmo2qM9vZQGVhPPIgoRsrNg0bzFc7vGog8hIcFJNJH+HAGb:wu/dRTUPE2bQFgoYbzFcTGohhz7NJHQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756869955, "uuid": "d2029109-a27a-46bf-913b-4b1f2cbbade2", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756869955, "uuid": "58e1d9a4-8eed-4466-978a-872d6621c313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869955, "uuid": "991e8157-e831-42b9-a33e-db487db9c503", "value": "AA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80707cf2-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872876, "uuid": "2695b991-d5a9-4f46-8cd0-ad88d01dfefb", "comment": "Malware payload (Mirai)", "value": "0186fff21f5328ce5334c9e0d3da99a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872876, "uuid": "05421c0e-a73b-42d8-baff-d568f8a361f0", "comment": "Malware payload (Mirai)", "value": "7cdde7f23b054fb32613f187c715ed30987b7158286c4b66b658b1b6e7daf635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872876, "uuid": "8d394ee4-a141-44e5-bcad-f80c80e29616", "comment": "Malware payload (Mirai)", "value": "452df96c13342b9e983b36aecbc2e3abbfd468b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872876, "uuid": "9abf7c33-bdc2-40c2-803d-ca66efb4c890", "comment": "Malware payload (Mirai)", "value": "2de2641234799314dc58888a7d5f6f48ecb0a716a32832308142be2c56848927ce141cc1d1e99186b530b935e65a50f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872876, "uuid": "d129d209-fb66-4d2a-a9c1-1d6c13f7ba12", "value": "T19E533C8AFD91CA16C8D9527BBA5E42CD372553E4D2DE3303DE15AF253B8E92B0D2B500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872876, "uuid": "35797db3-4eaa-48b5-ae68-f653899fa150", "value": "1536:ujOFQVj0h2nbQ5Adk0YuQvxKfknNm0sT:ujOF0j0g05AdJqvxoknN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872876, "uuid": "2a992cb9-7a73-4e09-93a2-cae12aac80d5", "value": 63004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872876, "uuid": "2a4331cc-4796-4019-92ba-b15af02993c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872876, "uuid": "47eaa1a2-23c4-47b4-bf66-41aa81d45202", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d676316c-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1756891918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891918, "uuid": "f20b00b1-3932-477b-8239-dc437d6afc32", "comment": "Malware payload (VIPKeylogger)", "value": "5c98e76ac4996efdee62a4da09baca2e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891918, "uuid": "d0c2a0fd-01c0-4026-acc3-42a6aea89a1a", "comment": "Malware payload (VIPKeylogger)", "value": "7f0f163959167b201b99ebe9695944e5b9c3ac7536fc84023aac565b0c21d3d4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891918, "uuid": "cdc618aa-ffd5-404c-b566-1893944badb7", "comment": "Malware payload (VIPKeylogger)", "value": "1a902392cad725b9b72834e2b7404d4197a406e2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891918, "uuid": "dc9b6a8f-c813-4c72-b15e-8ea86d940b88", "comment": "Malware payload (VIPKeylogger)", "value": "01c6fee6f333615b1261689ed8e7a0e4fbfc36857009c511c929418bfca803ab521c7f9e83d2b1cf6a44eb6545287eb8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891918, "uuid": "d503b6e7-5a00-490f-9f73-8ba83576880f", "value": "T10E62FD3DA554EFF00B1F62F0519B7D1260A5D322A9399E7DB8DE81643F322518FA50EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891918, "uuid": "2509cbb4-3c92-4231-99c5-0ff7a70ca4a6", "value": "384:GYs98Kw+0+2mKG/Kt/S2AUvyPly1Bu6efli+:k98Kw7mzyQ2jvkly1Ai+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891918, "uuid": "a0b5d7bf-e9e5-42e7-ad67-aa34808f4a80", "value": 15762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891918, "uuid": "cfc7326d-e3f0-404d-bca7-05f64894b894", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891918, "uuid": "7ea2a38f-eb99-4ea7-8f68-47008db97823", "value": "30%_DOWN_PAYMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11e90d0-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894056, "uuid": "2b3d0388-034f-47ef-aacc-045918700631", "comment": "Malware payload (Mirai)", "value": "f1039779e59bc4810ec2cb6f518bd75a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894056, "uuid": "e08566cb-1b8f-4c34-8d30-63e980a3048e", "comment": "Malware payload (Mirai)", "value": "7f256697fae67a5f8c08b5c83b609e896a86ba09496e034dd0dcf93582986607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894056, "uuid": "a9d8421b-dbb6-4822-b19c-3ab90aeda752", "comment": "Malware payload (Mirai)", "value": "73a046ec9b398c148bfa74e4722d3af84fe7a7d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894056, "uuid": "dad7487f-94ea-4e71-92be-e9b0a7b40502", "comment": "Malware payload (Mirai)", "value": "e8b4002b7e81e382fed6870b9cb790aefe650ec7dd49d00417a9fa209c577e4e747feefcc50657e90dbf39e16960bbae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894056, "uuid": "cedb4a22-cc1c-4e48-98d3-04ea37958ab9", "value": "T1B843F7817881AA39C7C0577BEAAF104E3314A7DCE0DA7747CC180FA176DA91B0D67B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894056, "uuid": "cc427348-0113-49af-9f09-931082ada57f", "value": "1536:bmXou1DAd2Gmj+4jbZ92qK0zlKpg7MEhWm5uN:bm5jbZQ0z8pg7vD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894056, "uuid": "2ab5dde6-b5fd-48b8-b42b-9e39f93c442f", "value": 60304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894056, "uuid": "7ae85e22-9687-4817-92f5-0d9ce375eb97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894056, "uuid": "4c8c4663-b92a-4e83-b553-fc43d5bbb17d", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb87991f-887d-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1756873512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873512, "uuid": "edff4a57-c45e-4a2b-8841-cee2bfb17cfd", "comment": "Malware payload (njrat)", "value": "a3247e6b32e3b8828c6548c88e3e3c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873512, "uuid": "5d8b979b-87f2-496e-a80d-83869b45f3c3", "comment": "Malware payload (njrat)", "value": "7f930050a1cfb55393b738cef30ccfeeb540bb1d047ffecd0c2aaa038bf69c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873512, "uuid": "523d9cd2-ac85-421b-934c-85760bac374e", "comment": "Malware payload (njrat)", "value": "21501be17a3265c9badb95c61349b43e9b72db39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873512, "uuid": "4ae77098-1c01-400d-9fea-5b6ab8389755", "comment": "Malware payload (njrat)", "value": "cbbd0d256a15696620cfdab40113f161d74a36d3572002028cdd0bc6891ce7e04f4d522956a5c471bff9826ad6c1bdba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873512, "uuid": "5665a7b4-3604-40e6-ae9b-749d0133354c", "value": "T13813E78CB690E174D5FF8BF1B4A2B2890B71A01BA906D30F99F154D94B73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873512, "uuid": "b529c24b-1c8a-400f-b94c-dfd5eb61edfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873512, "uuid": "439dfa76-d5c9-4292-b4e3-5b7aeaf29111", "value": "384:YZyEvHn1iDcsyEqtBfkEGCOEhGyOEtzcIij+ZsNO3PlpJKkkjh/TzF7pWnj/greT:unHnU4pEqtNkE5SyZuXQ/oy3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756873512, "uuid": "0cb0725c-15a9-41d3-b10f-061865a04e86", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756873512, "uuid": "84f3c840-535e-47bd-ae35-3008c2232474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873512, "uuid": "8ae56969-bf77-43fd-b71b-f0992d5392a1", "value": "a3247e6b32e3b8828c6548c88e3e3c92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d767db2b-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876028, "uuid": "e92c0c4b-df2b-4ff1-a1ee-0b4fa012c757", "comment": "Malware payload", "value": "4167380fc4df8c0a49298bd89dbd67e6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876028, "uuid": "6d0ca1ba-424a-4bad-97c5-fea88dca3fde", "comment": "Malware payload", "value": "7fd8efd14071e0df87da43018aca9575d9a4e7788e37ba4f699c169253b258d7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876028, "uuid": "239b4072-3c81-480d-99b1-0b0ba21ada1a", "comment": "Malware payload", "value": "e223219827a957b2823614fe30746439b03a167c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876028, "uuid": "d485d619-6d1e-4044-b401-23503993436f", "comment": "Malware payload", "value": "43ba4330da9546de1a7af9b6dd94bfb77dae5363c2e26dc05748f9414af4338d75c9f39015b9b4f9d7cc6128daaa0fa7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876028, "uuid": "ab2c3043-c21a-45b5-878b-f89dc56050bb", "value": "T1E551D64E926137928F346F9C727A4C48800C96543CEF2E89FB6D9ADF161258770ABD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876028, "uuid": "97035f2e-f1b2-418e-bbeb-17f3b08db5e8", "value": "24:S/0LJgLRgZWpVUHUM9npUP8gIj0CWpuwKjkQ0tpTYCFMzU8N+6evI+b+/AAICz3f:SMdgL+7B9npE/bXMCI+U7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876028, "uuid": "cf8c0761-84e9-413a-969c-44832adf6888", "value": 2677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876028, "uuid": "2ef5c264-010e-4290-ba0a-9ab3ef3766a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876028, "uuid": "ce57cecc-a165-4dce-a02f-1ba748eb5b36", "value": "download-55.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe390fb-88b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756898564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898564, "uuid": "4c11ec51-2f6f-4ff9-94e7-06c0d1165b04", "comment": "Malware payload", "value": "4f3c232916eed01baa6202ce8b729579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898564, "uuid": "9b426bf9-00ed-4ae1-ba3a-838a0a376484", "comment": "Malware payload", "value": "7ff33b3e060a6045efb6c0aeb8389a4a92e5188d26b241ad9d429e46dbf9463c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898564, "uuid": "482759e2-9227-4fe4-b2a5-3d839eff69da", "comment": "Malware payload", "value": "dc26572f4020060b784b9e21183d9510cafd4b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898564, "uuid": "f0074afa-451c-44dc-980e-70448ac76e07", "comment": "Malware payload", "value": "4cf558ca37ebe2d39f36d8b24988b6c953d94064fc5fdfc18505a7653f8503457f97c6aa3e5e5bbda07d8a9f7d0c3633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898564, "uuid": "830f2a76-1dc8-4c3b-89b5-4487b4bcb44c", "value": "T1D8778C1773A50195E8B7D2388AA64203D773B86347318BCF32AD06552FB7AE05A7F724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898564, "uuid": "2d452abe-c395-4613-bcc2-5b0c5ddee8ec", "value": "7b253f5612114989fb8a0d7ad0c42c8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898564, "uuid": "213765b5-f20e-4f3b-ad26-39ea25db17ca", "value": "393216:WF0TihrqK9QvSqbOsZXMXbQ4UflU8AR4h9iBTa9UIVWzTSDCcL2F5aAc:WqgODXm8EVQtVVDCcqbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756898564, "uuid": "b6bcfba0-0664-4cea-a232-855787822d5b", "value": 33491676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756898564, "uuid": "593d38a2-fa8b-45cc-ac9c-9826ad552f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898564, "uuid": "1f7cff3e-86ab-4b28-95c8-bc153faa9cc5", "value": "7ff33b3e060a6045efb6c0aeb8389a4a92e5188d26b241ad9d429e46dbf9463c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796de8ec-885e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756859979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859979, "uuid": "de196c81-eb72-4890-b02a-3d9a20c6c2ff", "comment": "Malware payload (Mirai)", "value": "fbd79647c6edef0f2598266a9c372d87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859979, "uuid": "fe36eac0-d5e3-4b22-b6a7-d37d363bf922", "comment": "Malware payload (Mirai)", "value": "805f7622938b17b78660339b7c353edfb470ab1df42274c17a5b9a758a58fce6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859979, "uuid": "7ee81840-921a-410c-8ea9-93bc55e29a1c", "comment": "Malware payload (Mirai)", "value": "17162e3a6ae34f5d8b17e7c3518aadbe1ba5fcbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859979, "uuid": "39b35622-e756-4227-9ad9-dec038f93725", "comment": "Malware payload (Mirai)", "value": "77d118f8b46cc76046b0d2bda4516224d974e2b2d0b544d5c1138ade51c6a8620a8226281d7d9e09a2e77f582d0e69ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859979, "uuid": "b402e05d-c4fc-4b4c-b349-1aa87a18db0d", "value": "T109D36CB2CC256F58D669E1B1B4309F7D1B93995082871FBA16BBC2788043D8DF6193BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859979, "uuid": "349ffa83-4c0a-4559-ab9b-636c34e63e95", "value": "3072:cXACj5MCvFzO8sMFWNSf2LzhzurhWzgQ89Nsf+:cX5M2iNyWNSfsmszghNsf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756859979, "uuid": "bc99ad34-bba9-451d-9bf6-456f8f534758", "value": 142140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756859979, "uuid": "8d5409bf-d0d5-45dd-8281-5b13c4108fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859979, "uuid": "5382ceb7-1e33-474b-aee5-7eba1b3c0686", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd68b762-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880762, "uuid": "82450bd4-ea2f-4e2b-b4a9-1dab80fd43ac", "comment": "Malware payload", "value": "3f83f0e97874717339938a93567c1280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880762, "uuid": "2b3afc06-ebde-4ed7-8782-ee7bc5951fbb", "comment": "Malware payload", "value": "807618d12a7a6d069f036954783ed681f3ce0990df4d28fb894755c7151c93a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880762, "uuid": "bd454296-5e4c-4f92-bd75-1a7aeb463349", "comment": "Malware payload", "value": "a26d59d60aab6e6aeba8e3edc829e5096b870999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880762, "uuid": "3fdd1097-fd6c-477c-a4b0-815cdcb426c5", "comment": "Malware payload", "value": "9a613e7efd97ca3566eec5d5347f02994942ade2af9fece9858b50c51e2ab905291bd07c662fece59b77908ff1a8f3ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880762, "uuid": "75cff41d-9eaf-479e-8d13-94389c2a8f9a", "value": "T147E5332033E6C6BCF9D443B69A9293B2C9ADD87A0B1187C365844C497C7A3E7517E4C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880762, "uuid": "e0d5f356-6cec-470c-8008-fdb788c9b36a", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880762, "uuid": "379c18d5-be9e-464c-a00c-1b45f3f22229", "value": "49152:Ha5e8WtGHrdnWrif+Dz566eGt2K1K90sHQTXpvIfsULg09MymZC:Ha5e1+jf+Dl66e6x60sHepvIfsUkhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880762, "uuid": "06dffbaf-18f7-481c-adab-0d8c7a2c3ad3", "value": 3093341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880762, "uuid": "50d20fb4-f5ae-4bf6-95b6-25b2fcda8bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880762, "uuid": "793f5756-d590-4367-a0aa-e8249593f283", "value": "3f83f0e97874717339938a93567c1280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dec30db-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866832, "uuid": "0847b8a0-1d25-4697-8c26-b7ad8c9ca6eb", "comment": "Malware payload (Mirai)", "value": "22130105491fd85c3efd79b41f5c2ba0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866832, "uuid": "9661c314-36ff-4014-84ec-514e425d0d4a", "comment": "Malware payload (Mirai)", "value": "821434b207f8ef816a0272697a83dc9a28539e2d07abc9cbd19c5f7e11d67a07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866832, "uuid": "6e186f22-2783-474d-94c8-b85a04246b8f", "comment": "Malware payload (Mirai)", "value": "98190aea5a99f62a3845b747654cb1798c55bc49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866832, "uuid": "8871d08d-11af-4c0f-8b30-e97d1a5617e3", "comment": "Malware payload (Mirai)", "value": "b3768ebd48761f31f5ed5e1d321f340793d867897667519370b3eec3a8d61e32be15d210e79e78c48520bf767ebb329f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866832, "uuid": "725aabf2-d269-4e19-aa1b-b3c972c0a5e0", "value": "T194230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866832, "uuid": "56c17b48-3b1a-4a3b-bd0e-298894701cd4", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THc:5DmKF7Gxyk8cqoHAmWurAufsG5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866832, "uuid": "5148ee0e-ed30-4d61-a54c-6c6d42b93ea3", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866832, "uuid": "1fa47729-9cf1-4f56-abaa-feb9d4bcea25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866832, "uuid": "4fb15b83-2f19-4dc4-9c08-aba25e4ec063", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c2dc2e-888f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880834, "uuid": "033c19e9-498f-4e76-8e5e-dbc6a7977c4b", "comment": "Malware payload", "value": "f83d3c7318eafd65ad7ea3d555940e3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880834, "uuid": "c713822c-70b7-4930-86fa-1ff4c9c3f014", "comment": "Malware payload", "value": "8236d68b427425865f3bc208e484566ae8445454c3e506e36bdaf0cdfbb948cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880834, "uuid": "ee37885b-fe97-4f06-afd3-961b231ae936", "comment": "Malware payload", "value": "4b31e81408eba1d54d7280471717d89744335f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880834, "uuid": "8318b7b4-3f89-4837-82e7-3d923d333567", "comment": "Malware payload", "value": "aebaf9f46dfb78c8810694ff594ba83b0e7e50a30667746edbdbd0cc737f5a331b17fcba13b00e3baa6e1b2c44fa3955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880834, "uuid": "1cdba3f9-9a55-4a4d-a27f-4890074a12b6", "value": "T1B2D3C52837E5205EE37399398FD5AC7DEB31A2670207B75B7023125A89099C9CF617F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880834, "uuid": "e1dd6fbb-3d07-4c67-9d4f-7247a7d06d89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880834, "uuid": "f8c7463e-4999-4012-ad4d-a8d0731834fe", "value": "3072:X4VQBq07/1S09usb2aCgYtWH2AvmZzPmAwCR2S:EjsbsgYtWH2AvmZzeAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880834, "uuid": "31645b5d-c6b7-435f-bc2f-e38f8b68ad29", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880834, "uuid": "0c6a431e-85d0-4c37-ae4c-8b9ffac70721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880834, "uuid": "d0c849de-8c99-43eb-be20-9de8fc9f8f68", "value": "f83d3c7318eafd65ad7ea3d555940e3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd6b06b-88b4-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1756897029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756897029, "uuid": "163c5f8f-66ef-4f57-9572-dd77eeae3358", "comment": "Malware payload (DarkCloud)", "value": "32f59e2188955f0e0951c57cd3e0118d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756897029, "uuid": "c7f09342-50e6-49ed-acae-c36636b531ca", "comment": "Malware payload (DarkCloud)", "value": "829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756897029, "uuid": "7c745bd3-5634-41b4-a65d-41699ea51498", "comment": "Malware payload (DarkCloud)", "value": "72fa9b7bef782240e6be43563ea6899be1ae6193", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756897029, "uuid": "e3809e54-34a6-4678-9d4e-462d5e95ecad", "comment": "Malware payload (DarkCloud)", "value": "60cc9c22748f51701d9c3ad5df0cc613eb4f91cc7a94b86cb29044e8ba900646866e671fd773f68b0ae30383944180f1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756897029, "uuid": "551f4cfe-a0cb-475c-b859-389353fe9d01", "value": "T13ED36553A50350749E7B62A3DCF7711AEA2000DF1829D448F94CD79AAF7E28896F37C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756897029, "uuid": "a445d2a9-8fb9-47ee-b077-4850f7d72352", "value": "3072:1lz/PD5fng8XOswWl3qf2pKinkN8umBJnmv2PXpxo:5fng8XOswWl3qf2pKinkN8u0o2hxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756897029, "uuid": "e9701556-91d4-4334-b031-7169ebf2bc5c", "value": 142455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756897029, "uuid": "55eed25f-944d-4324-9325-dff5060f46d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756897029, "uuid": "923c131a-bdbf-4644-9c3e-5522342eeb98", "value": "mondayscript.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16ee053-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756891936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891936, "uuid": "7c1acac2-6e49-4ef1-a265-1b484352d6ac", "comment": "Malware payload (Formbook)", "value": "c214931e0bf0e3a60d6a05a59aac3f43", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891936, "uuid": "090549bc-9f42-41e4-9244-742d24847d02", "comment": "Malware payload (Formbook)", "value": "82e6ecd478b2e1da4ae6da19adb8e345f56837137e4ed885a2ca1d097c63c390", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891936, "uuid": "892b3787-8133-4c9f-a11e-5bb7c22731b5", "comment": "Malware payload (Formbook)", "value": "c6a33e4eeef60165a5ec03b9bd8d1b0a28b3b16e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891936, "uuid": "2db7ede5-6f62-46f8-a04a-e56f06805671", "comment": "Malware payload (Formbook)", "value": "d7f75c1a4a9466a49e8026de6046f80737f63931531084467f88e94f26e007eebdbc1e67b6625508dc1e605df328791f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891936, "uuid": "9fafdfec-83fe-45b5-904b-ac0c0aba430b", "value": "T15085C09D84B19CD2A064FE74E685FBC78CEA43851A2B07520FE495963342C43FEA73B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891936, "uuid": "7f643c0a-14f6-4b85-87fa-bef86cc034f9", "value": "12288:LzeBjbJSIBImQG3lbZSi1EPUIK5cjuj2ndi9VAE1oq9mN5MU53c7Pr8/SkyMLsOj:eVJBwGfIg9VBgY4qYG2nBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891936, "uuid": "894aa702-bff4-4557-be10-ae40c5bc0e77", "value": 1818656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891936, "uuid": "73b68369-3d50-4cf2-b63d-74cb20457425", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891936, "uuid": "eaeca115-2898-47ac-9d42-c8accaaa5e2c", "value": "Technical Spec..vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52321445-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756923049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923049, "uuid": "15f85d22-6103-463b-8728-2e9714ac7c80", "comment": "Malware payload (XWorm)", "value": "6f6c05727eda78746c282c27ae1e04d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923049, "uuid": "5385d167-454e-4b7f-88b3-ea067fe6f7fc", "comment": "Malware payload (XWorm)", "value": "82f320b21342c883ecfdca917e16e98c0ddbfbf118f54b817aa9bfa20ed29e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923049, "uuid": "5a4e39ec-5484-4f8f-878a-192ce54b0d33", "comment": "Malware payload (XWorm)", "value": "0af26dc87c79451defa4816c55037740e8f55c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923049, "uuid": "b91594a0-3441-4caf-a9aa-c478b77a3a29", "comment": "Malware payload (XWorm)", "value": "b2c5842644ceeb846fe741c1151aef6a60cfb02d5c31bfcbc515934414868346ad53954fd52264a4b481f9fb014a59f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923049, "uuid": "f07fe142-3203-4d8a-b82c-5d3ba0dbf910", "value": "T1F2837C6837EA461AE0FFAFB049F17963CA3AF6235903D55F20D8018A1713AC8CD516F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923049, "uuid": "ab7ec05a-8fbb-4d58-913e-a6a1a8f2d1e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923049, "uuid": "0006807e-5bba-406c-b2c6-419e4e2087ec", "value": "1536:j9cZX/cPDJeALRtp3+VbGMOrVEcobI6YO9KSg8oHvIE:Zicle2pmbGlpjOcCoPIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923049, "uuid": "452ebca2-e184-4440-bd58-388511b74c81", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923049, "uuid": "0a838a98-8545-462a-881b-82b35e72e391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923049, "uuid": "bdbca294-1c81-4d87-80ab-35511816be75", "value": "Taskhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c6b6b5-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876027, "uuid": "fdbe5b77-d953-4c06-8584-6b751434c456", "comment": "Malware payload", "value": "dcd1486b7050692f5df7e4e581c73a85", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876027, "uuid": "aa61030e-7490-4356-b201-f2a2b76c132a", "comment": "Malware payload", "value": "8553b4a53ce223e0ba8f202ad0bf361ee89b3b62a814ee48ae6284e4c53a8283", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876027, "uuid": "4e206e62-bc2e-45e4-9d93-8fa7835ab09e", "comment": "Malware payload", "value": "3b06347a473f8175f30ccd6a5de5da2cf94249d8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876027, "uuid": "cdd35463-0b0d-49f2-b0fc-31fd8bac5b41", "comment": "Malware payload", "value": "f89b2f35dcd6e216b26170574d11d664eaaed2dcf3297d96dec1a8b8eabdb5d76409efdb7ce15a569ab979ae5e46713f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876027, "uuid": "df752759-bf05-4a26-ba2e-e90a04b7898c", "value": "T15461815E201752D2DF08ADECF2E74C94A00C53907CF71B8EFBAE5A679819886704BD17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876027, "uuid": "2568ddcd-1ff1-46e9-a421-66b04b1df075", "value": "96:m6B9np7DZHqoiNRgYgQYFlSvDjvmF5ikV93QM/Bg4FVdk68:lB9np7DZHqoiNRgYgQYFlSv3vmF5ikVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876027, "uuid": "f3e3dbf9-fca5-45b5-9022-3e1a99283cea", "value": 3213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876027, "uuid": "3afdeff5-b754-4dbb-bd32-2323d42e3d0a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876027, "uuid": "a450a270-f755-4a88-bde9-eb9ad888cfdd", "value": "download-rocky.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47719e73-88df-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756915300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915300, "uuid": "039ff431-690e-49b3-8351-7a06e1c4a7ef", "comment": "Malware payload (Mirai)", "value": "c369dbe1f91a9cef222b7e9172273bd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915300, "uuid": "538d58d4-5deb-4cc5-9991-0a3d7b2c19a2", "comment": "Malware payload (Mirai)", "value": "855ac14545d65a55f7340d2d69342f6d34798ce124961932215af9698c763eae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915300, "uuid": "5f70ceed-5961-43e8-8fc5-30dfb2f51e65", "comment": "Malware payload (Mirai)", "value": "3074b375ed33c036fe1554c085b3c633358843c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915300, "uuid": "849ed9bd-e9fe-4769-9256-7b11dde6b0dd", "comment": "Malware payload (Mirai)", "value": "94d83bca9420df7d7f91c9c6ff94bf405593edacfe5d631539be47134776d064ce300d6567664f393af8c94a70a25662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915300, "uuid": "f2d9bfbd-8727-4095-ba7c-0fdfd9c25b04", "value": "T19783122570646BF0D1586435CCAEBA9EF6061BEFDF5E66D416C60D0D5A064A322FC1C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915300, "uuid": "caac21ac-6c62-4d2e-b7d3-b48a8d9dae1b", "value": "1536:tl7AvEK/PTyrVO6VRXjRYRE6aid21DJgHmZlRKQLSxKkZrfCbyPg:tl7QPerk6f1YCNid21DJemZlRKQLlkZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756915300, "uuid": "b071036a-3362-4730-9028-f5b1fd9d153c", "value": 83056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756915300, "uuid": "115dba1f-60fd-4fe6-b2a3-2c399b787241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915300, "uuid": "288b0c5d-c161-4e01-a3af-2fd18fc2bc59", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e5be15-88d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756911935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911935, "uuid": "a757bd76-b486-4e5d-9969-c9e1579ed8b5", "comment": "Malware payload", "value": "7214000df463c14a08877d1eab366e9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911935, "uuid": "885f1b38-0963-44d5-b523-dce0c85e6529", "comment": "Malware payload", "value": "85abadd0a3c3e84403d69e0c68892b7aa1e3b276ce17efe6de094be7085dae12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911935, "uuid": "94ee86a4-b62f-406b-8892-0908f1f1039d", "comment": "Malware payload", "value": "b85fbfc605951cb9c19c25f72092361a4796555b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911935, "uuid": "531e32ae-112c-47ec-98e5-16d15520930c", "comment": "Malware payload", "value": "2bf0c5a0dd1186b32fa1acd7a6805c855ab20bb279b8f8af6d16efd51bd0b0a524017b06aa4594feb90e02ab5ca159fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911935, "uuid": "d78752de-43bb-4be9-881e-26d93558e6e4", "value": "T1F9045A12337A0863C0E9A87562F38333F7B69B850AB85507BB64AEDC2F597C031577A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911935, "uuid": "13759aba-cbd8-454b-8e4d-629869419eb6", "value": "3072:kp7n7Bnt5fA4z+JbBl2XuIPUmxtjypm/j+sZoS6QTf5m:az7BnAJtlDra+pm/j+sZoS6QTf5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756911935, "uuid": "3ca4841f-7acc-4845-9388-357cfbbfb954", "value": 180581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756911935, "uuid": "ff3668c5-4c30-45a0-8687-6d87e3e142df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911935, "uuid": "df056596-1606-427c-b93d-f7a1eb4c734c", "value": "test.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830d4356-88d3-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756910246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756910246, "uuid": "f2355702-242f-4c81-b8de-ae473a7274c8", "comment": "Malware payload (XWorm)", "value": "e844f8f6573cb3b48454b0a6e591a695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756910246, "uuid": "cf159a99-e004-4890-8ab6-ee71eaab69cf", "comment": "Malware payload (XWorm)", "value": "85e1cebb33b89a3d4d0d73344272bfdc74da38cf540721bb8426c23a7f444241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756910246, "uuid": "e9ff5fe3-d1bc-44b2-a1a9-3e54f0161023", "comment": "Malware payload (XWorm)", "value": "309a5aa593b0be9313a21dbf84f5e47601b2aff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756910246, "uuid": "ab62418d-aca6-402b-b746-53af4c62fc05", "comment": "Malware payload (XWorm)", "value": "4cce9d888344a9a5bf7586058e7ffb3cf71f54a14dc0fc8d7f8170f4c5f417f3ff1e388fadb064d40180ff00cb4a649a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756910246, "uuid": "52bc4db6-1887-433f-9c26-bc696939334c", "value": "T19BC3F11A56D0C2B1FDB79671A5299E2066FD2FD5481F9BBE380A033236B2318CCB5F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756910246, "uuid": "b5213781-32ef-4f71-bd09-819a23b3287e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756910246, "uuid": "56a476b6-a2cf-422c-a9cd-4743316c0aa5", "value": "3072:wxFPaO7F2cmfGsFnpGp+VTyWQHutKimyTG6+JiwN:wrR7F2tGsTGp+VeNOtKDyTyYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756910246, "uuid": "f39b917f-b2b6-453c-ba94-2ce7b4b1450f", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756910246, "uuid": "07179b7b-904e-49fb-b8c8-da0fb28138b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756910246, "uuid": "7333b24c-17eb-4df0-af31-72c2c80b71b4", "value": "85e1cebb33b89a3d4d0d73344272bfdc74da38cf54072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7917993-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756891946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891946, "uuid": "e4b1968d-8be7-4340-991d-f7359219b95d", "comment": "Malware payload (Formbook)", "value": "cadbdea9f4e286df75dd099b2aea05e7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891946, "uuid": "f4298c8b-972a-43cb-b753-95a00df8be43", "comment": "Malware payload (Formbook)", "value": "863a70794e9f45a1b02bf9cf8d54b7afa781b3da2240d5efbaea7029f129d814", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891946, "uuid": "6bb29be0-6ecc-405f-95f4-3d54939e8b6b", "comment": "Malware payload (Formbook)", "value": "1cbed275e8df34a141ecc94eaa796199e4ef1236", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891946, "uuid": "4b48d59a-8680-4747-addc-e7599f4fb4aa", "comment": "Malware payload (Formbook)", "value": "dc06c1d7ba282399ccf0be7a4d02fc5d352bdff92d794c1f3c3649223206342de79c4e66f9db1a9f6feaf9b0bc1d93e3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891946, "uuid": "af3e70cd-0ced-4a05-8575-fb2dcbdd052b", "value": "T1DF93480AA6EF400DB0739F559ED361BA6B6B7D65353DD089108C26090FE3984C9E1BFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891946, "uuid": "4e8ddb26-ae61-4901-b517-a12e0020047b", "value": "384:YyiwasMfs7dEa+Lrar9Tlf0AAhuwnIr7kOPP:vrsa+Le/0AAh+XfPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891946, "uuid": "dd94ff17-7295-4866-ba22-4dbd77907f1e", "value": 89718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891946, "uuid": "e6bdc411-ba75-4832-88c2-a4fb413df380", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891946, "uuid": "7671f8aa-e55b-4fdd-aec5-a6f7f1693e9e", "value": "Ordine Rif 00668319019386320.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e7299e-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756891840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891840, "uuid": "6325e2e2-a499-4c70-8830-bbcf49b5c99c", "comment": "Malware payload (XWorm)", "value": "dd9f133fe4ab8de7d93845d27d1e0ec9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891840, "uuid": "a829f6e0-0c07-46f0-a214-63c73a1295cf", "comment": "Malware payload (XWorm)", "value": "870e13f74435cfa499c3a6db21f49d2217f0b654f937f28e7cb461eba698d1b8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891840, "uuid": "fe7bd25e-476e-48c2-a89c-eb8b71a92cf6", "comment": "Malware payload (XWorm)", "value": "fc4e04aff159696d5cebf1dbe54b0e5fa0712791", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891840, "uuid": "24d01f76-127f-4e39-aa25-7504df442353", "comment": "Malware payload (XWorm)", "value": "dd417bcfc189c79c1695779e67815d663b50fca21f903128bb7173fe639a1f99555c88683be0c44834bba7cd444e6015", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891840, "uuid": "9f046bfc-0787-4d7e-bd8e-042c47708184", "value": "T1DBE3933CD6B5ECD8037F70E0511E3F12119D0BA3B6711F6CB8C11AAA5E2459AEB7A64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891840, "uuid": "fc876ec1-34b8-4752-8b83-5aa08e973b93", "value": "3072:nWBKq2uFx0jQpKeXhNBlAuNlVRMYUgBiDUOh3:nI/2uFzQeXPBlAuNlVRMYUgBiDL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891840, "uuid": "b71bb731-7d72-4120-9c0b-6e0554e479f3", "value": 155943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891840, "uuid": "47540263-f149-4afb-ba25-42fdf06eee71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891840, "uuid": "33458755-a2f3-4fc5-9d88-d73ce0015354", "value": "SOA.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70559795-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929972, "uuid": "83326ea4-f318-4519-93a4-9ce217e71612", "comment": "Malware payload (Mirai)", "value": "cfe35985581d86ee1dcf5dc0a47e0b10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929972, "uuid": "8e2b6daf-5c67-498d-85d2-14a40ccc4885", "comment": "Malware payload (Mirai)", "value": "8712b050e7f76126ff8ef783d9626936c5a3c85cb0ff33420541574f7189ba65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929972, "uuid": "0a965379-d9a7-4cf4-ab55-0f232dd50e61", "comment": "Malware payload (Mirai)", "value": "b02d2a879c8123275f73def194d2541f482614e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929972, "uuid": "dc3eb6bf-0679-474f-b3d6-5225df697dd4", "comment": "Malware payload (Mirai)", "value": "50605a4161243d1e55e51c57f4b314e42a19634e1ce67af8f3095fb9bd32be3b5d1ef693e6d782e0f4144012502feb7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929972, "uuid": "900b6d58-5493-4840-a266-0c7a54fc79d5", "value": "T1A0532991FC819A13C6C022B7FB1E428D3B1A1768E2EE73079D256F21378786B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929972, "uuid": "47158a83-d296-4099-a9e3-771bf3818c34", "value": "1536:cYH2uawU5akti1f4zIih9Aq0rf3wauvzy:cY/1kE1AzIinu0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929972, "uuid": "8bf57b80-4ae2-494e-9c15-2ed5dad9a88b", "value": 62604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929972, "uuid": "8fd2dc69-dac6-4291-bddd-6eedfdb6b895", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929972, "uuid": "540f6990-2054-4adb-aecc-6fd195ffb465", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661fea57-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1756929954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929954, "uuid": "d81e93f7-2944-442c-9010-d260ba809a44", "comment": "Malware payload (Gafgyt)", "value": "3dda5beff46e23a150bfc120076143ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929954, "uuid": "4b3682c0-a0a8-46cb-87e9-cf8ded44a597", "comment": "Malware payload (Gafgyt)", "value": "8747c82e5d76ae190b57f144196395f8a2ea7ad693db6d2107d6260f15a7e1dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929954, "uuid": "dd986353-6e9e-4f2c-a5b4-feef43e84bf7", "comment": "Malware payload (Gafgyt)", "value": "362e3f68d298a91a601ea510e66ae9783d7534c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929954, "uuid": "c83b0371-ce04-4336-b309-fadeb13add1b", "comment": "Malware payload (Gafgyt)", "value": "fe77a68d7220f280acfbd5507a718e19a13a8f5dd33515141a6e866ca2461e753e6a69182eb9c4a1b4a7948bca89aa6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929954, "uuid": "7179aeca-69c2-4ddb-b108-18897818cb57", "value": "T14113F2826648F42AC1E06C36DCBC4DC65ADBEFF8E3AE41437DD411A8F66921353E8243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929954, "uuid": "66854909-143e-4ffa-b1d3-501fb7b9a111", "value": "768:/PHNiBA+E767/D7FT//b2RVbj30rtea9PJsq3UirTiLnqELEdq0vhCu:/Pp+is/D7Frb2RVbj3seuI/LEdzvMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929954, "uuid": "36cc9268-5a7d-49af-ad0c-0c5268712f9f", "value": 45136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929954, "uuid": "52982147-5640-4044-ae9b-ecc170099e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929954, "uuid": "7a04bbce-5a23-4afa-87be-e69225bb43f5", "value": "fuckjewishpeople.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6fbf62-88a3-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756889623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889623, "uuid": "2c1c488a-7c70-4256-9670-54878a2e2516", "comment": "Malware payload (RemcosRAT)", "value": "04ece47ec15af25de415d098b03ae978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889623, "uuid": "623d8749-3aa2-4416-b17b-f29de84b9491", "comment": "Malware payload (RemcosRAT)", "value": "879ebda15ee112aeb9ab2af26cf2cd59967cd64ced4fdafc3e571caf100ea5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889623, "uuid": "30e35889-d5cd-4344-8750-0e88b80dd8ed", "comment": "Malware payload (RemcosRAT)", "value": "62a4f8ec4da263a514864393480949ddfbf26502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889623, "uuid": "2b87b93a-0b66-448f-ad13-2435733a2dc9", "comment": "Malware payload (RemcosRAT)", "value": "16229ef5efeba1eef48fdcea9896652597ef8f56db333612fb905a8f879841a872f24136f4af092a53a47f713fdea75c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889623, "uuid": "c3b77e2c-16b9-4d64-87cd-b884075843f4", "value": "T1CDC63A70C39151A1D2D7C870CE964FF965E1787B40365D0E16C4F82A29FEF21AF9E2A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889623, "uuid": "3bea3093-5558-42a8-a4f1-ceca2a6c5743", "value": "a2b303e926eb240cd7d8a9918edd7322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889623, "uuid": "f84bbfb4-59fc-4139-b564-5acab6c73dc4", "value": "98304:GtT+6cKsASd15TQgaqfB6JlbOx48+XSw7BxO8i:Gty/K015TQZqJ6JIx45XSw7BxTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756889623, "uuid": "876cd6aa-bda8-402f-afcd-34f479efb897", "value": 11471012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756889623, "uuid": "f217b766-dd27-4feb-89f7-ebb2f3fc153b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889623, "uuid": "8a0b9642-94b0-4bb4-be94-56c8aad4b0ba", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cac3b7-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929956, "uuid": "3179bdf0-94b0-48dc-ab9d-2b198ea226d0", "comment": "Malware payload (Mirai)", "value": "cfb4657897c783e8838aa036a8adc0b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929956, "uuid": "03b0c1b5-ed96-4410-bad1-8debfbfa94a7", "comment": "Malware payload (Mirai)", "value": "87e1d4d789b6a3374422651403e2c7595ea5d708b28cc8a43499162db0f30b26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929956, "uuid": "e3af93ab-ded1-4742-bd91-55b9d83c1ad8", "comment": "Malware payload (Mirai)", "value": "aefbfad13ec136b60f75c7429d223aa00ec3a051", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929956, "uuid": "c1f5e0aa-98e0-4b7f-be59-8c2bfca30572", "comment": "Malware payload (Mirai)", "value": "2379cbc1145c4f05f180b3f5d1cc9d3a31143f8030cc9349a72024e27255246f32fbd93abd9d3b536398fa920e59e772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929956, "uuid": "cb7b59f0-f410-4936-96e2-e3cb5231a108", "value": "T1FB536CC6928BDCF6F85605716033E77B5772E42B202EEB8AC728D570FC96900923769D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929956, "uuid": "25abdd31-49dd-4222-8423-336fd597b5b9", "value": "1536:YFSAb3sPn1UWQYREC0Wp18CSZSPRh/JsOiMFTr1Aw:EBbcP1UW3REC0Wp14Z4RLshw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929956, "uuid": "7768117a-cc68-45fb-bc9d-998b6bb8558f", "value": 63156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929956, "uuid": "28ab9f91-a660-4f8d-94b6-636952fe8f5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929956, "uuid": "d6c3e6b6-5f89-4e7d-8423-31f626dd1b00", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71096511-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929973, "uuid": "710c672a-b654-4a2d-b114-26c3c44e01e8", "comment": "Malware payload (Mirai)", "value": "b3ac805bc7526b287e20b95d66c104d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929973, "uuid": "8d4e4c4e-2cc2-4833-8d1d-2eafeba62485", "comment": "Malware payload (Mirai)", "value": "888df068c7071462ab97cc12c11f25a5377e3dc9fff68543fb65c0bb34b234df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929973, "uuid": "cd75d9ca-e084-420e-9680-c6ef4955c76f", "comment": "Malware payload (Mirai)", "value": "1d56f768fe118df10e30ac9a7e53ec4345c7187e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929973, "uuid": "8cf60010-3681-4edc-8a33-89711da98267", "comment": "Malware payload (Mirai)", "value": "8724dd1c0168e3362f3ca495a0c3a8a42bb3f4a16c8eb468fcf36d03d0bd1825e7c4592551446b3b6cfbf4bd0dfd5dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929973, "uuid": "55db0213-2f5c-4b24-b58a-30d3dc99fb1f", "value": "T1C5231752BC828A56CAE42375FA7E42CD3311B3A9D1DE7267CD205B1036C991F4D77B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929973, "uuid": "2080a587-1d75-483b-96f7-48af17389f60", "value": "768:dbfPA1RUGzxhmlgrgrqEVlwYrLOnsiduepi0eRAI1V+6ogWwweBNOE9g:BHAnF3mmrg7LOXd9pi0eRhP+La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929973, "uuid": "8fa089f9-6bc8-4e5e-833b-fd0f195e1146", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929973, "uuid": "71ea2b5e-ca67-47d7-9196-28af5ed4d657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929973, "uuid": "3dfc3db7-045c-46a1-aeb6-50f3bbfdef38", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1c64c3-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756872033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872033, "uuid": "7a994172-6286-4fa1-9d37-dc62ca4e2b55", "comment": "Malware payload", "value": "0085ea82d5daf69f75fd791727309c7c", "object_relation": "md5", "Tag": [ { "name": "skateboard", "colour": "#D99960", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872033, "uuid": "1c1ad0e5-5f6a-4759-9e08-fe472c466c37", "comment": "Malware payload", "value": "89d876c7d02fb9634aac11398ee0268040c4d75db4d7e8572e432c00907f1fb5", "object_relation": "sha256", "Tag": [ { "name": "skateboard", "colour": "#D99960", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872033, "uuid": "8d8370b9-a4d8-4115-a86f-c3bfc3a60225", "comment": "Malware payload", "value": "d15e6e3dbf059ef9c9757056e49dac8a72259de5", "object_relation": "sha1", "Tag": [ { "name": "skateboard", "colour": "#D99960", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872033, "uuid": "6f7669e8-a994-4a2a-9de8-d2a0fd0c1d1e", "comment": "Malware payload", "value": "8dbca8f2bcae35ac963bb9cb7b2d70f574fda9769481538a1e4d9a959e2f5450aa87d7feb379806cb0031001647bc380", "object_relation": "sha3-384", "Tag": [ { "name": "skateboard", "colour": "#D99960", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872033, "uuid": "7d9ffe81-f754-4af0-85a4-5f773d4be025", "value": "T1AB3633F3D99557C986C11795B6D0FA2A2C6DFD00FDA4C9B0273F724A2926D0E20A3D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872033, "uuid": "e750f229-5735-4d14-a8b2-9520eb3425c5", "value": "98304:hOu44aRtTMfa4TmS+k/IgAVO3jPBA1Da6oVHDC/37qo/lajcGdPP:QKaRtgfPm+VIu3D037z/la59P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872033, "uuid": "0aa1b0b1-d307-4b0a-8c6c-0a5018251936", "value": 4993688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872033, "uuid": "06ab014b-3043-4c5f-9529-58c3852485ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872033, "uuid": "5df4bd11-764a-4c7a-b8ba-71d028bf9f1c", "value": "skateboard_output.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df4faaa-886a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756865140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865140, "uuid": "d0b7e87f-37d9-41e1-9fb9-0cc4a8db77f7", "comment": "Malware payload (Mirai)", "value": "ffe1f43f5aaa71f0174cc344731b3658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865140, "uuid": "59744fd9-8f66-458b-9a16-9f31e6865d0d", "comment": "Malware payload (Mirai)", "value": "8b242278ddab534d5a54e1872908a9c7c6a1e6788be2330c262017b57d72ca0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865140, "uuid": "757cae2b-df20-4fa5-8e4e-15758ce29cf8", "comment": "Malware payload (Mirai)", "value": "da57070021af08a4534fd9e57f511f8596e5abfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865140, "uuid": "dd221123-ff46-4363-9f0d-5829c17fe0be", "comment": "Malware payload (Mirai)", "value": "e7abd2db0f7ea784a645433541a407cde29aa9d019964b498862dcebb20b74d4b90f2cad486770c89df240b230e91fce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865140, "uuid": "aed6e3ef-4646-4406-81c3-f1adde4ac357", "value": "T1BF736C80F78FC5F5F18305B1C06BD37BAB38AD2A9005DA54EB89673AFCF1692850A11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865140, "uuid": "57703f1d-3e45-48cb-a139-26a4f894aaa0", "value": "1536:0Apg5O7ynZ+b4c7mvy9gr48X28v9gkUZL5azma8QQDLSOrora:/pkM6q9WX28vu9vaCa81DFca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756865140, "uuid": "5e6e225e-a953-46e7-905e-739603ff5260", "value": 74964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756865140, "uuid": "a7fcf0b4-f752-4ff4-825d-0d48773d8f4b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865140, "uuid": "9be13c3b-a6c0-4ba1-895b-dc9fc72b2f26", "value": "kitty.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d836c032-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1756880754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880754, "uuid": "55ee4f1d-0250-42eb-ae28-bf57eb942e92", "comment": "Malware payload (Rhadamanthys)", "value": "49298a35caf4ab64a6a3597ac2d7ccf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880754, "uuid": "7b02c951-6145-440a-8150-41a1468504a5", "comment": "Malware payload (Rhadamanthys)", "value": "8b96d7418b5d6cc0169711e903229636f8640038b6abd6bfdfdba69021cea767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880754, "uuid": "9eddd1d9-e202-44e7-b120-2be55f2a8bc8", "comment": "Malware payload (Rhadamanthys)", "value": "ad9f48dc28e50871de4a87f3889c600ce19bdd4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880754, "uuid": "aa944dc3-7f8e-4ff0-b864-0444dd91083f", "comment": "Malware payload (Rhadamanthys)", "value": "897572e69e665852b6bf47109a51c368e03c66dd305f69b952df07d73b0d2508d8d87eb2475c18f62de9ba82059182d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880754, "uuid": "faabaa84-82e0-45a8-bdf9-20aa7e5a35e6", "value": "T1D0151281F5C3C0A3FA6310702F78DA75983DA9A26B351CEB7264456849F69C3C37396B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880754, "uuid": "7055b093-fc10-4b9f-af81-4b516df0799a", "value": "7ccdf26f81c5c13d798e8a7ffab09084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880754, "uuid": "096acdfd-dc42-4cd2-a288-120ec593b238", "value": "24576:Y2HdJsviS8xGGBf6dI06xPMjqshfmpXTRi5V:3HdKF8sG16+0O0j7m9U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880754, "uuid": "754309e0-605f-45b9-9fc6-0e76c3d04e76", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880754, "uuid": "decf2bc0-72be-49ae-9a69-92fbaf770979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880754, "uuid": "61f70fda-b471-429a-9d6f-80560fffb22e", "value": "49298a35caf4ab64a6a3597ac2d7ccf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a806dc28-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756872083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872083, "uuid": "c72a22c0-4ddf-4700-b8be-e48e91e47aee", "comment": "Malware payload", "value": "dd69c4d8a1e82b551dffce04a2a965de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872083, "uuid": "6034987a-2b8d-47c7-9abc-be2358b17524", "comment": "Malware payload", "value": "8b980a3e33269d3784065e3786e80bae89ab3bd1bdf94a2d370e39111f7f45e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872083, "uuid": "d4682421-5990-4253-bfad-caf279cfca9d", "comment": "Malware payload", "value": "ba214683d5815e3f02889c03ed62c3210f8ff1a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872083, "uuid": "5bb1759d-b943-4cfc-85fb-c45879822190", "comment": "Malware payload", "value": "887e4050f3204fbf5e651f1634349fd634d2047aa59f998cf6083b61c5f2dcf9490cc07e406a061a65e48aaf9fc6d418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872083, "uuid": "70d0709c-9fbb-4e0c-8a3f-db8abc57fcea", "value": "T168E60731A89118A9C477A1B2B965E2A425717C58432036CB3ACDF1E9EBF06F65F3931C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872083, "uuid": "af3c023b-0492-4bad-90ff-e7dc344a1cef", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872083, "uuid": "67724e99-a3ac-4566-82e9-b9285f796119", "value": "24576:nGINC7xQ5Wyv2L/zHrPQyr2b78TwQOXnQoUqdRR:n+7DyubzMlTz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872083, "uuid": "c311caf2-2914-4c7c-bbdc-14ebfbfd3cad", "value": 14969465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872083, "uuid": "c3fa0283-134a-4d65-8237-2db2c4757da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872083, "uuid": "d39e280a-bd8e-4b30-a930-ec61b538da3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f81721-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880669, "uuid": "4f9a8bef-4df8-4b07-be77-cd1be558bc2b", "comment": "Malware payload", "value": "1ab6904dbe712ffff428679809998c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880669, "uuid": "69ae4c22-62b9-437a-adf8-62ab43594777", "comment": "Malware payload", "value": "8bd92e3775c3e30e1e864cb0a48518e744477c719aaa6f61960efa0ef2df6da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880669, "uuid": "b37670cb-c60b-4ec9-9c3a-58613e7d664c", "comment": "Malware payload", "value": "05b8221468f579aa722e16a2fac21aaa20d2abe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880669, "uuid": "4e8e788d-cea1-4c5f-a7a8-c0795e0d6ccc", "comment": "Malware payload", "value": "d8e05f893b4d21de2efea3beb0650bcd13cf6dcf289aa5d3e0ad536922de5bd3a168d48aecca1b7d5483ec5e7a2f6069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880669, "uuid": "d7d97356-42b6-4f9f-b7a9-b310ddf15328", "value": "T1FCD3C56837E5205EE37399394FD5ACBDDB26B2670203B7577063124A8909AC9CF613F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880669, "uuid": "e4f1956a-954d-4db4-a490-b524078c912b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880669, "uuid": "1ba07a0e-1138-45d7-addd-42d3d942911d", "value": "3072:t4xTXTnr2Q/K09usb2qCghDAOLVhvmZzPmAwCR2F:Syjsb2ghDAOLVhvmZzeAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880669, "uuid": "7f20f3af-ddd3-47cd-968b-a9e14376b9e1", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880669, "uuid": "7fbbf8c0-0243-4fe1-9bbb-7632fb51cbdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880669, "uuid": "c2518d7c-7415-4295-ae6c-3437038a1155", "value": "1ab6904dbe712ffff428679809998c1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224d8797-88bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1756901494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901494, "uuid": "d78c4200-798a-4f3a-a93f-979539b50c41", "comment": "Malware payload (SnakeKeylogger)", "value": "d0f60ad099cc4bef5645335d5fa3e5df", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901494, "uuid": "a67a3e4a-5bd8-4939-bb8f-226b4d7051c2", "comment": "Malware payload (SnakeKeylogger)", "value": "8c6eec28987e0d235236b1be59e0ced0fdd8dab7bc23f5fbc7edd037f21c8f94", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901494, "uuid": "cd223ead-3a1c-4701-bd84-d272c7cb891a", "comment": "Malware payload (SnakeKeylogger)", "value": "0a66d4d8c334159293cfe9ce2d7ce5f3eed0fa6c", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901494, "uuid": "bdd3a6bf-ddb6-4831-a136-d5e7bff96944", "comment": "Malware payload (SnakeKeylogger)", "value": "28808af9a1ab0e612632a457946571ec6f79611718fae668f3a11c0ac985fe334bf079da8de2156a35c735b83542fe94", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901494, "uuid": "82d86b68-87bc-4c29-91a1-de7f629fb3a9", "value": "T135C423651C161DCB08666E75E73F9A009AAD78882C038AC3FD9D7ACC63D9396A80F5C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901494, "uuid": "54984682-d83c-4dce-be99-c069b89b8b20", "value": "12288:0dzytsotYRzzy1Y2tATZfZMTgjNKGSSagnDjed3Bu7:0xyKotYRytSxsgpKyHw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901494, "uuid": "c66a0fea-3190-407d-befb-8650b0432492", "value": 595804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901494, "uuid": "623499b1-538e-4408-a0a6-8b2e8f887233", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901494, "uuid": "20bb54e6-38c3-4953-8d15-f1e65e37097c", "value": "CV Erika Urbina.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620f1bdd-88f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756923505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923505, "uuid": "ed805d5b-3bd9-4d53-9098-090c2f86b573", "comment": "Malware payload (XWorm)", "value": "406fdcf7cc9995809559f4bc950042c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923505, "uuid": "ddd07560-8d5c-436a-b856-1ac7fc4c6f59", "comment": "Malware payload (XWorm)", "value": "8d96e934f73fc76b56f624f3cbc9d993c1cedd731c073c3ce885627e0d90c9d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923505, "uuid": "51472fa1-387c-432e-abc0-d2a504486950", "comment": "Malware payload (XWorm)", "value": "4419cff0cd3727bf3ddb4b865158a3212548ffb9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923505, "uuid": "a86f456f-c30a-4bf0-93cc-03e0c5966c41", "comment": "Malware payload (XWorm)", "value": "aa250a19713e5db25234cafb3781382e61ba297e4f4981f6fccb61c055d54e3620d0ec44b262b3995a4fe41d5c7fe8c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923505, "uuid": "6fd29639-80ea-497e-901c-f89cd85677c7", "value": "T11A33D78E6315AE4841E747168BD87F36F1BE6CB12DA1ACB4484EF9C18F071649ECCB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923505, "uuid": "46cb262b-ccf2-4f94-ac51-f9aa1b105729", "value": "192:hrykdkWaRqcgr9ioDqWg5Zz3d27qTGnG2xsh:h1iRpgJl3eZrd27q6nXqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923505, "uuid": "5ebbd666-2db2-4700-8b95-7bee364dab32", "value": 54312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923505, "uuid": "1415b801-ea42-4ba0-8364-0b204194a421", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923505, "uuid": "5779f1d4-1231-4940-896d-2b8b0844840f", "value": "ITEMS LIST.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dec56de-88d8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756912412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756912412, "uuid": "3e03dada-ea08-45cb-ab7a-a74bd8c8f125", "comment": "Malware payload", "value": "0c1c6ea8da98b0dd58b1fc5eccae3ddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756912412, "uuid": "1555ee11-119d-415a-90bb-8ec5806dff7f", "comment": "Malware payload", "value": "8da6a4a5e75eccc8a6bc234f7819f90ae21bd02ca5209eec4c4ffd29650f4372", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756912412, "uuid": "4495a326-8300-4cab-9d01-02aaa872943e", "comment": "Malware payload", "value": "c8d691b9f23e53e61bd03324b48f558e2a9431cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756912412, "uuid": "132cc929-70fb-431b-a9c4-6d79a89d2938", "comment": "Malware payload", "value": "547cce293e3af55f2ada86a784f385833b5397465ac8f584774fffdc6f6b3255e6c148174f6f46b7f88113e225973396", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756912412, "uuid": "d9d7b363-16e4-44db-aa95-47de31860756", "value": "T1F3141A83F515D5F2F40EE73308D34B256272FBA14A531A32A3177A79AE392D4346AF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756912412, "uuid": "91ed60bb-7aff-4865-867d-e96fc57b171e", "value": "6144:w38K8SkDQekacWVcW0JcWcBlYqe1mZLbmDGmm0eczeA4XpDY0u5m:28Gdimm0eczeA4XpDY0u5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756912412, "uuid": "d6519363-a829-423b-9202-56ef5c226351", "value": 199042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756912412, "uuid": "495cd786-7ec5-4341-a1f7-34692c86aa41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756912412, "uuid": "3940e62a-2e4f-46cc-a97f-b11e73c2ddf5", "value": "test.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e8f6fd-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1756872026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872026, "uuid": "a87dce76-cc2b-4c70-b51b-c58c5bd73ef6", "comment": "Malware payload (Stealc)", "value": "1827b1172225d836ba58fe55c9eda1ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872026, "uuid": "704a029a-8d39-4141-88b7-811c5a4534d1", "comment": "Malware payload (Stealc)", "value": "8e02a14d123e24ae6416c999224d4065d9c54d46e76bc7d277bcca256ca4ea68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872026, "uuid": "adf71134-9146-415a-96ca-7aca06326eab", "comment": "Malware payload (Stealc)", "value": "0552f8496d60061671e615fed11e7a1d6674f346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872026, "uuid": "e8bfd0f0-e1bb-41cd-900b-764401445dfe", "comment": "Malware payload (Stealc)", "value": "a26541aec3c8d26362f8df5ebd500c6fa8405423b2317d6bc749e0bc8870f4f1a6da1fa1b8464248c4a57b8fff8b24bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872026, "uuid": "1ea20fd1-5e41-42b5-849e-af48857c11f9", "value": "T19865F118AC7590DAFCD340706F669112E533BD3BCF242EAB51E48B111A57EED0E3A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872026, "uuid": "13de8774-2ed7-461c-b553-e3548308c326", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872026, "uuid": "f6b7e18e-cbf1-4c43-ac68-c778ef248efa", "value": "24576:DUYxEL+Rbj/0c9qx6rFdmJYPXxyZb9dzyZfn2G+I+t99OFwtHV3yAHPcZ:DUAE69t9qsFPyZbXzyZv2G+II9mGpHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872026, "uuid": "6a8e9c94-eb43-4e10-9927-9527977665c0", "value": 1476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872026, "uuid": "dff86766-b3d3-4e0e-ad1c-019b9f777810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872026, "uuid": "6a91bfe3-58a2-4706-94a9-e30f7deef9f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ccd973-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913289, "uuid": "f01705ad-af0f-4880-8a10-ddfad35c4114", "comment": "Malware payload (Mirai)", "value": "c6f122322dfa6c78010798c5dc122452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913289, "uuid": "750b229e-f431-4eb1-aad2-e6599bac5956", "comment": "Malware payload (Mirai)", "value": "8e1e06561d8d155243c78fd7e1cd25fdafd5d888bef8e13ee3fddcaeb6e58ecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913289, "uuid": "6c280e2a-eef6-4a2f-9e01-8451cf427865", "comment": "Malware payload (Mirai)", "value": "cbe22df3ecd2258d011a6add23c69c7381fbf637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913289, "uuid": "a6775619-59ad-4af0-9670-120306eb4098", "comment": "Malware payload (Mirai)", "value": "008a6cc100b49155bcda264aefea25590e265c43e35e1d0c8b3d9eaeff7b170afca34eefa20a8b97a85d7cd17a8c1954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913289, "uuid": "0d458d4f-67c9-4e31-880a-4b742d4e6cb4", "value": "T1D6B2CF3C5B111B58DA1EC0BD43AD1B513CB81B2591429E8B7207FDD79F9A8743453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913289, "uuid": "4c2ba4b2-7f59-4379-9ebf-b1adf0e6633e", "value": "384:6eD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiqwmd1JgGlzDpH7uNj1JAP:6eD8ZSWvZHZbs1row697qohQvg9Ni1Jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913289, "uuid": "9b57fd07-55a0-400e-b643-97b7e7fd0a6a", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913289, "uuid": "b5891c59-5497-4199-b3b7-df3680d00ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913289, "uuid": "fd07e167-28b5-4bee-859e-7e0b52397e32", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf3204c-88dc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756914182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756914182, "uuid": "98038354-8d1d-4877-b0cc-8509fc358420", "comment": "Malware payload", "value": "f8d9b7c864fb7558e8bad4cfb5c8e6ff", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "NotDoor", "colour": "#CAFDC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756914182, "uuid": "1c76f7a3-ed51-4cf5-a8f4-5c969886c402", "comment": "Malware payload", "value": "8f4bca3c62268fff0458322d111a511e0bcfba255d5ab78c45973bd293379901", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "NotDoor", "colour": "#CAFDC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756914182, "uuid": "550112b9-9e55-4919-8e49-371779c3ddf8", "comment": "Malware payload", "value": "a45ab1a9dec488278ee9682735d42d61dfc38b9e", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "NotDoor", "colour": "#CAFDC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756914182, "uuid": "8a0e272f-3e01-44df-99eb-a620f2336d21", "comment": "Malware payload", "value": "0556f3391fb5364b06c7faea7fffaf69db4f849c5d807272f1ec710cb04ce2e0f7263ad9aa223313ed652519dfdc8203", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "NotDoor", "colour": "#CAFDC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756914182, "uuid": "e7191c07-fc9f-45bb-a785-e791f1634fbe", "value": "T11944D699F05AC12EC7D815361C9AD7FE26B97C079DC0DB8336AE732E2FB6A59C040641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756914182, "uuid": "8751877c-d43a-495a-9cfa-df80ad2bb4b2", "value": "6144:5FlXoKOs8GeWQ6BSpQS6eFlqoKOs8GeWQ6BSpQS6:flXowSpQS66lqowSpQS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756914182, "uuid": "28223a2d-266e-4f6e-a243-1fbebb732c4e", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756914182, "uuid": "bc8abead-61ff-4def-a7b5-28011a6ff5c7", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756914182, "uuid": "664c90c7-485d-4e8f-ac30-979eeceb76ba", "value": "testtemp.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e309a221-88a1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756888932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888932, "uuid": "1b3295da-ccaf-4295-bbc6-f1feb5b096a6", "comment": "Malware payload", "value": "eb3040a733af831099b43cd557b31a68", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888932, "uuid": "aa5e0859-8ba5-4dc3-9139-71bb32a2aa29", "comment": "Malware payload", "value": "8fe017ef37ed33f41cc84c1a46c27d091fd8b3d08a01cc847712557be543628c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888932, "uuid": "3cb3904c-c86b-4251-8e90-eb13a5908397", "comment": "Malware payload", "value": "a18aa6d4dad439b8832152d6d353f4b1f2f7f848", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756888932, "uuid": "920063a6-ccaf-46ee-9c69-8e46e84b553a", "comment": "Malware payload", "value": "fc3fb009e95cd239aca8a051be4e288aa25475264220cae06ca566b208661fbd544f4c4f4a16d3368ed8220c5ffd1651", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888932, "uuid": "2dc7cdca-d0ae-4be2-8ad1-3620de530253", "value": "T1F0E633D3DA9C1C20DD0A227967633424B9C90FE16D4B66DE360412EE917BDF048967BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888932, "uuid": "eb5ce9d4-fd7d-4f55-b91a-458bc29f7579", "value": "393216:muIvyQ4mms6MCOLv+UFBM94EiQERVrvXafH8tv1Jiguqz:XIqQ42AovBO4ExkVrvXafH8HJBuqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756888932, "uuid": "e191a7a3-39a8-49aa-a204-717fde905e41", "value": 14594606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756888932, "uuid": "2dba3f47-c7b8-47ee-9ed0-e201caf0a655", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756888932, "uuid": "588692b9-d4eb-4dcb-9c5f-8060cf0114c4", "value": "HD (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89a3f75-88b0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756895411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895411, "uuid": "698ff17c-3a6f-403d-b246-5a53177dc8a5", "comment": "Malware payload", "value": "cc4b9ee53bf2e364d4dc745dd76b993c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895411, "uuid": "f8753eae-b2d4-4729-bd7c-0fbdf7d57435", "comment": "Malware payload", "value": "90bdf6cff6f69afa7d96ee98dd2f1bdf0310e2fa771ca77624d085dc4f60f557", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895411, "uuid": "476db594-caa7-4647-992a-a18af9c053d7", "comment": "Malware payload", "value": "1e6e204415bfb62ac828ee36234005893155cb89", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895411, "uuid": "a5535d7c-e0c2-40d2-a08e-366b461bcf54", "comment": "Malware payload", "value": "da964e96c9fafb97ab131e0498271a646d5d14a9372de1978b3fb6ae9687c7295fbb92427186d14d4b1abfee60a51ad0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895411, "uuid": "8f6b8b4f-9394-4efb-bf5a-2ab43a6615ab", "value": "T148E3D13A0A3C3756893E2404A8E638D7A5A0DDB99CF38DDCAB8B4C1F987CF5510955DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895411, "uuid": "e4ca4466-b9c4-4abe-8715-53a6e5620917", "value": "3072:QFosj5VD1ybmulhOfMhEEAq8jlzYyzece6keA+GNQAnICt:XcMCKOfMptelcyrqQAnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756895411, "uuid": "c9beba8e-491d-4373-af21-01075f9ba091", "value": 149472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756895411, "uuid": "ae420dfc-d8d9-4d33-9dad-9512c9f38d8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895411, "uuid": "83f59f83-a7a4-4987-84ad-6e91e2247e93", "value": "Grandfatherless.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f888f3d-8898-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1756884927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756884927, "uuid": "45a43f49-4afa-4f65-97d7-9a7f66e9057a", "comment": "Malware payload (VIPKeylogger)", "value": "50a45ffb4edd95232ee419d8281a6277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756884927, "uuid": "39aa1f80-736c-4600-8536-669b8c65a690", "comment": "Malware payload (VIPKeylogger)", "value": "911d8e4c53b4226bb2e1ef12bd7aaf32e88f4f025cf630ad6b02b39261b9dd84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756884927, "uuid": "5221f261-15c1-4a1b-859a-6b2d1a9aee7f", "comment": "Malware payload (VIPKeylogger)", "value": "4e8167b8aede68fe4e0e29d65100d833ed200cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756884927, "uuid": "eef2a16c-1c86-4d90-af0b-899221db7d7b", "comment": "Malware payload (VIPKeylogger)", "value": "a867267775a0bf8c93b207909fd743ec7e99fa86e08bbcf4abcca1439754f1327fc840d02a52a2c76cedc09c118c75a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756884927, "uuid": "66e1afcb-2595-4ace-942a-ae00cbe205d3", "value": "T188E41264179AD903E9A25BF4AD60D33463B97ED9B421C3075EED9CDB3823B462C84783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756884927, "uuid": "da756d3c-2890-429e-909c-f298981d8e5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756884927, "uuid": "a85eafe3-3f78-4486-8b48-8d7467cc77d4", "value": "12288:qyb0OWZWG6Pdb44baSBf0jkrcTYb0U1SZcKCPrvzN/g62q/Wf6l3a5cv7BM8q/:qoG2GSZBKYDjoVf6ti8q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756884927, "uuid": "6db2bfff-7645-4647-9446-8546bc52b104", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756884927, "uuid": "9823b8e2-90de-437d-9b9d-8f1cf974bfa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756884927, "uuid": "9a9669db-f62b-4771-b085-38d8bef3a3da", "value": "SecuriteInfo.com.Trojan.PackedNET.3393.18470.31834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3dbe27d-887e-11f0-91c6-42010a9c0006", "comment": "Malware payload (SVCStealer)", "timestamp": 1756873821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873821, "uuid": "b8329ee2-e2a6-4fb8-94af-b00cb1e5be9a", "comment": "Malware payload (SVCStealer)", "value": "fbbb1f02fc5738859814b71118a650b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873821, "uuid": "8407d1fa-bb3b-437b-9b56-49e95443c9bd", "comment": "Malware payload (SVCStealer)", "value": "91c48122fad932eb549ca8cf2734a73b21a5b4b2aefe3d86e675586d2ee091b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873821, "uuid": "8a73f441-5f96-4ae2-ba39-13833ee95b12", "comment": "Malware payload (SVCStealer)", "value": "dce0d8210b498e40f27a32219ff809b980cc97e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873821, "uuid": "affb37d2-3faa-42f8-871b-c0c2df2af71d", "comment": "Malware payload (SVCStealer)", "value": "8df12a61b49e3be96cc8e21755905f84a54df82749c03d95b493e5e78048b0de94287f71eabf2a4d4c1eebce2b5a9181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873821, "uuid": "83310a0e-d192-4adb-8bf8-4c6486e5ad5b", "value": "T19856335462A00EE6FAF7903DD8A4C811D673B4270711E49B82E4466A7F236F0EE79F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873821, "uuid": "ca561206-bd0a-4735-9f38-41ee40c76b47", "value": "456e8615ad4320c9f54e50319a19df9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873821, "uuid": "098c075d-c122-4860-bbf5-c525b8c2a706", "value": "98304:tExq2B/JWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAx06btVUJFaeP83qPb:tC0HiouWJysVYvsOaoyMxxvjDDAx0a0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756873821, "uuid": "c8dc239c-86d1-42d3-8399-0e01927cd0f5", "value": 5915939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756873821, "uuid": "8754831b-e4d2-4714-a9a0-726110c1e6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873821, "uuid": "2ec21546-dd69-474f-99cd-ad71f75f1872", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbae32b-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866776, "uuid": "23410460-0347-4b92-aace-bbb414e21be7", "comment": "Malware payload (Mirai)", "value": "9f31b506faf05d93f03985029f0dfe59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866776, "uuid": "34646e46-0f3b-4450-bbe8-0388603fd671", "comment": "Malware payload (Mirai)", "value": "91f98ecac5d92a9649c42d083dc74e306e012f1074bb510960250927aecdd8bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866776, "uuid": "e1bb0283-4671-4bd1-9031-a212331796fd", "comment": "Malware payload (Mirai)", "value": "3c5f553369e624693c9669f48cade983a2012077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866776, "uuid": "2e966895-2f74-45ee-8eb0-6cb8440118a3", "comment": "Malware payload (Mirai)", "value": "237a1808ab8af8c19448c074edc01d6e523ef9dc09aa9fdbf5f31c6cef0be350cd5c1d1c3027beab9ae833fc62fbe41b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866776, "uuid": "f16b7b54-4524-4c61-87ea-1c59ac7e90e5", "value": "T15DE37B8BB7026CA2C9918BF54BC747AD2B6322115F5BCBE76C0C6A3D4E219DD5E0B341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866776, "uuid": "baa6c213-34d6-4ed8-a182-fb9ede920e64", "value": "1536:344oygvT40qIYUqwhLgfKq+eorWUGip1ogLgI/LWaFmCrmKmuRl:oVeUNZUKJXGip1ogLgIqadrmKmuRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866776, "uuid": "3819e39d-6b69-4760-b916-70949f7ff6d3", "value": 150664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866776, "uuid": "5ec9970b-a693-40e0-82f1-c51b4481b258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866776, "uuid": "421b8988-0ef0-44b4-8c6c-85ac7eeab029", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b756510-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866774, "uuid": "15027ef3-dfdb-44ee-88b7-2dd14ecb5992", "comment": "Malware payload (Mirai)", "value": "4d0fb7123aaf71180abe7c73fc49f065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866774, "uuid": "10bb4b3d-ad69-47c5-804b-cee04cf38152", "comment": "Malware payload (Mirai)", "value": "9323b265d490a6862a3ba4f302751d096feb1323f879c5d3a5a5869cbe756987", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866774, "uuid": "13a814b8-af0c-49a6-9784-a3f47de3a3a0", "comment": "Malware payload (Mirai)", "value": "cfd7fd3be702eec3a7359d698177d5329f77fe82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866774, "uuid": "6ffb83a4-e596-404b-9885-2bf0207ede6a", "comment": "Malware payload (Mirai)", "value": "a5c53c9436c5730317130b665d81c30624f108907301d7d15f4fa542347491a292cda09dca84f1317302f7fdcbacde95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866774, "uuid": "3c9f3e0d-37a4-4c64-b683-4cc4d569da06", "value": "T182B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866774, "uuid": "e843bd90-ec55-4b29-b209-2b89428b996d", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1M/LWy:c9sSyzz36YaWWgg1Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866774, "uuid": "2fe5f9fe-c43a-4bdc-a9ce-65622c28d185", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866774, "uuid": "481277e7-2e45-49a2-903b-c68dfb663bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866774, "uuid": "4c525069-b913-489a-901a-dfeac9a944d8", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be48084a-88b1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1756895743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895743, "uuid": "e93e6e38-edd3-4a20-aeaa-fc2c534e73b8", "comment": "Malware payload (Formbook)", "value": "822322c7680f2e216cf678131a9c8bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895743, "uuid": "93e117ed-10c2-4383-aada-74aca3796ea0", "comment": "Malware payload (Formbook)", "value": "94976e161177276c6c1f03697f87bbbda781fedb937342a311728f51a3bce501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895743, "uuid": "a8eb3acc-0427-4342-b4ea-31cedcb08dc8", "comment": "Malware payload (Formbook)", "value": "0074ec60eeb85a53cc6b443541367a10181358e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895743, "uuid": "174b1d1d-43cb-431c-92bf-cf47f8e2d013", "comment": "Malware payload (Formbook)", "value": "6d2e48d5f99d3433ca50273cd2790faebb8396b91e354ef01d905e688219868d97c2093db8c3deace9653c84a004b2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895743, "uuid": "7fa0cc31-2800-430f-bf14-d054bc0ff190", "value": "T1B2D412882397D513E5B157F08CA2E378236A6EE9A401D3078EEDEDD7B435B503E91682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895743, "uuid": "80774c6e-92a1-4f49-8190-979e99b46aca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895743, "uuid": "d2a5e8b8-4d03-4c2d-8c6e-652003eb9c54", "value": "12288:+gH0OW0npG4iTUTHZPYlubXYq0ZG5b/T8p5JVOX:+anplNYAboG5b/TW9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756895743, "uuid": "6ca1850e-d950-4336-a6db-bb7040176889", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756895743, "uuid": "b020138d-84e9-4596-96e4-56a5aa78156c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895743, "uuid": "00479e83-c0b7-472c-9fe1-9b7c7bc2a963", "value": "1.3- Material List - FITTINGS Rev-00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080c8ffc-888c-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1756879546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879546, "uuid": "ccc44f50-1a10-443a-b829-56fe066312da", "comment": "Malware payload (PureLogsStealer)", "value": "de9fe81dd0a1a61b02dbc84cd5479535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879546, "uuid": "92692f68-f1db-4ad9-8eef-62e922f897d9", "comment": "Malware payload (PureLogsStealer)", "value": "94d3ea79f8c5ca711431010276ec84db1eab20e8d33f2c2293e8f3347d378adf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879546, "uuid": "80a71bd4-999c-49f4-9d09-f640a9b3c1c5", "comment": "Malware payload (PureLogsStealer)", "value": "916544a5d4c48b2a36da93c6c7a13ee582e33e6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879546, "uuid": "53e5f144-d558-4993-a7fa-0dbf6eead14b", "comment": "Malware payload (PureLogsStealer)", "value": "905e1d3dcb4982a6e12b52488003069c7e8841a4100c1d60a911ea66b80d796e1370f332766f20aaca72f845094e7030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879546, "uuid": "3ddb3e14-8b75-4b52-ab33-5cce69574c1d", "value": "T1BA85230BF94FC2B0C2909BBAC4EA869503B9C740E657DC5B79FA278E16137FD8940587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879546, "uuid": "22e29d8c-f2d2-4661-b68d-ac7532aedac8", "value": "49152:0rhGflnXlXnm3pyw1XfUXngXjAGslTF2euhA:0r2nXZqp5f0Pueu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756879546, "uuid": "24c9281c-18cf-471c-a180-aa78f4f78612", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756879546, "uuid": "4bc0e9fa-0a5e-4f68-b6d4-ddbcffe1dd18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879546, "uuid": "de6a60ed-845e-4f7c-8c70-13506b7243f5", "value": "de9fe81dd0a1a61b02dbc84cd5479535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b72bed5-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872867, "uuid": "11eee545-86af-4cdc-b042-9bf6c9e4c275", "comment": "Malware payload (Mirai)", "value": "eae0677fd96f3c85e0bc75976538bf64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872867, "uuid": "a8653a59-c045-4671-ab3f-8a719fb9b128", "comment": "Malware payload (Mirai)", "value": "959935a38228590b68585b19855d35397cc9c8d32c3d78c84460e827e33c66cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872867, "uuid": "fcf5d9d2-0a58-49db-8fdd-cedc9e8b2c9a", "comment": "Malware payload (Mirai)", "value": "cde2ed279c79a462fbf83ac48f131f8091909fa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872867, "uuid": "46ef9bae-3065-4f14-bcbd-d4bb6ed17cb1", "comment": "Malware payload (Mirai)", "value": "d291b568a542d42dc4405a4b41d6ced7d6fc041079ed152fd953eb1e93ae375101ddbae6286f9996f4705af81ed4a109", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872867, "uuid": "6ffa83cd-0288-42b6-9018-7231c47fd4a2", "value": "T19B433AC5E24FC8F6DD061275247BA33A5A32F93D1075EB87D798F530AF93611A18A28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872867, "uuid": "d76dfc8e-e86f-4711-8743-03744b983fdb", "value": "768:ypwWuXKzaTeL/FehY7IDYztN/txC69zouEfIn0tOO0nhtdgsT:ypwiau/bIDSbr39JEfI04O0nhtdgsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872867, "uuid": "f9d4a749-7d83-457f-b7cb-3789cadf5dd0", "value": 58736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872867, "uuid": "cc7f3e47-0821-469f-a09f-dbad39c62704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872867, "uuid": "a3541394-8647-4f85-834e-5f1571337e82", "value": "bot.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c25d112-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872680, "uuid": "4ab4bc95-18cc-4b9b-843a-521892348e4a", "comment": "Malware payload (Mirai)", "value": "174ed9c8d189f7b7c4503feedd679fbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872680, "uuid": "bab5d117-793e-47cd-995b-34156102d927", "comment": "Malware payload (Mirai)", "value": "95ad9b479b5b9a43adcc9c47216878765d71f26003706adaad8768af372bb050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872680, "uuid": "95634843-945f-4ea8-9703-1fa9f75a9d14", "comment": "Malware payload (Mirai)", "value": "35a2fca68a7e1423ebe3ec95b34ead2457f1ac4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872680, "uuid": "6a43a9f8-6347-4566-b2df-f4b243397981", "comment": "Malware payload (Mirai)", "value": "58d6a6616fbb88891e21807593f208f5118101de7e76c003b0e7787230322e7b5e1c1cc5dd8cc58254107094318283d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872680, "uuid": "72ecfe4a-4d9c-4470-b349-a913886cb670", "value": "T1C221BD9667D76D27CC444373DCDF5714E362AE94869EF513E72212290C3F31A2F2119A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872680, "uuid": "f62c4406-d3bd-4a94-8e91-0923d77b3221", "value": "24:JYolMlgP9qD0at6EoNGZrUlFSy43zLCkIdsgHiGIppMppNfc7:JYolMOFqDPtLrkFSy43zLoiGIpSppNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872680, "uuid": "bb4cea03-55e6-4607-99f3-067e5725f670", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872680, "uuid": "6b3da584-70d4-4257-9fef-4588d3b66821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872680, "uuid": "bdb1a102-7948-48a0-b977-336c8fe4719f", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3788be8-88c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756902650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902650, "uuid": "4981908a-cf44-4145-b318-53581e1a5d99", "comment": "Malware payload", "value": "b06e78ef4c6c2388dc5cb36572a2a0d6", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902650, "uuid": "a39e1bd0-3e85-493c-804d-ff53fddc843c", "comment": "Malware payload", "value": "96dcdb792bbe478b59e45a8b7bbfc5f9c4970271b602c3ae62e6e70451940d10", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902650, "uuid": "2462a9b7-c029-431b-be05-8f66a95d91e8", "comment": "Malware payload", "value": "46966e6cb88f0bdc4d7bd69081771502545ce96e", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902650, "uuid": "a87d30b7-ada7-4f37-9b78-05e8b868b1c9", "comment": "Malware payload", "value": "ddd671d143a73616b1a7ac70ca51f993fae02922577fc04542d2f958bf4927f746099b0cf4e1620ba2f94b7266b8a066", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902650, "uuid": "73b98271-e48a-4c0e-a9b6-5c07c1f6b847", "value": "T177019C156E8AC97144338556965EEC0DF38493231020ADE9F848C69E1F3D3B745923BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902650, "uuid": "115423b2-f562-4e68-b9fd-278b2b325eda", "value": "12:Ffc+QF66jfh8bvFsZun59LlqdO7/sUQ5jMtZn/qGRHF5tFDy/487bj/Mejy:86MfgT5h0dyQ5jMXn/TFRyZHzM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756902650, "uuid": "65b60c9c-f051-414c-9437-853e8f4ca544", "value": 791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756902650, "uuid": "d5d2ec27-8bb9-40bd-8134-72fe0da15b65", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902650, "uuid": "1bff2ebd-e27e-4112-952f-1cec0d5d44df", "value": "bill.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467adcf2-88ba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756899407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899407, "uuid": "5a65bc89-8eb7-452c-b87a-f758af864225", "comment": "Malware payload", "value": "1f35f549b741cee8bb50b55ab4e0ee7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899407, "uuid": "84b7219c-0a10-4df6-92bd-079e4dc4c4a6", "comment": "Malware payload", "value": "97b2588f938cb00e2722645865a7fab1ade3b969d8a5e5a0f8ec02d8578632d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899407, "uuid": "50fe49c1-3da3-4c26-aff9-e490b4fc5011", "comment": "Malware payload", "value": "6d7c0d51121d35e09f98ce24eb35d3200314d471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899407, "uuid": "3164d82b-7e05-4bb7-9307-c234fc40c2b0", "comment": "Malware payload", "value": "b7a80f3353adabbeac238b42883416fd1ee2528035a7291342f27d88c63e7984f35b047e158c15a45ced1544ce2527da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899407, "uuid": "88ca8a72-d2b6-482a-8e4a-7d03d5beb8c0", "value": "T1B056777047F666F2E601C4B1123979FF4BF686B2A518C8DB61852EFACC1AB8707355C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899407, "uuid": "3134450a-2107-44ca-885f-c6779cb8fd46", "value": "24576:X3aOJq5bgjJKQvL5jicrCVMZPM88YMXU59SqNwB6Dsd2uqDP2Quck8n:XrJq5WruwL9MX67PUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899407, "uuid": "c70fa7b4-1969-4165-9623-255cfb53605a", "value": 5968384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899407, "uuid": "5046a528-1b49-4151-8aa9-2ab5f7414e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899407, "uuid": "55f9e454-f9f2-43f1-be5d-1e5bf2bf560d", "value": "97b2588f938cb00e2722645865a7fab1ade3b969d8a5e5a0f8ec02d8578632d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dba81db-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913297, "uuid": "85d5bb0d-e428-4b7c-abb6-d06f4d80b222", "comment": "Malware payload (Mirai)", "value": "e44f088d9d8313dab925bd068241fcdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913297, "uuid": "53d91fba-5938-4d3c-a72c-09d59767764e", "comment": "Malware payload (Mirai)", "value": "981e40eaca72e93f0185c2ccd9053465248589bafa7f39fe387650383d4cecec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913297, "uuid": "6e618949-a96d-4402-92c0-7e4dd77220a1", "comment": "Malware payload (Mirai)", "value": "75ec1cf9da78a9aaeae652a96364ee09dfb60650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913297, "uuid": "8fb7f778-2c59-46d7-8412-0f0fd96cfcb7", "comment": "Malware payload (Mirai)", "value": "f6b64bd9c5676398b90af4146c2947a049cd83d4ae33d3187fd4860b1f2ab8753c4f4a89371e8613db32ed53ce52c445", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913297, "uuid": "5ae0e9d2-82f8-493d-879b-80c2ccd08954", "value": "T17CB2C0CD65943084C98D7C7C178D4A674F6CA190BADD9B26E350CD98B3BEA4B385D0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913297, "uuid": "c7cde861-3bd4-4640-b824-dcf79bbd5f92", "value": "768:okrQlS07dEv0UXqUhvQE+CXQKMQKCXBp7ZqsWvy:ZQlS07FUXqIYSXQKqudqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913297, "uuid": "fefe26a7-37d9-4307-b47e-b2c56e8ae778", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913297, "uuid": "cb0cce52-2ae4-4960-b2f6-2078d8c41207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913297, "uuid": "042e322c-2366-48bc-b032-10e3e2b67006", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d243e927-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894058, "uuid": "8ef9e69c-76ed-4b5c-91c2-646180bb097a", "comment": "Malware payload (Mirai)", "value": "95eb755ce96df3d992f55204a84d617f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894058, "uuid": "6bb99ea7-56de-428a-88ac-d533dc89efb6", "comment": "Malware payload (Mirai)", "value": "9937e0f2b527d2e1198e547240e0d2361cf17e94c622ac09bc80cad324c23450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894058, "uuid": "ab9d1aa6-6169-40a4-be94-710711980de3", "comment": "Malware payload (Mirai)", "value": "e54f9d0161df753e85ec329e38fbf7916ef79de0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894058, "uuid": "d103176f-e59c-4e7b-9fa1-f65b7e81ef77", "comment": "Malware payload (Mirai)", "value": "d6e3feeb3d9020dbbe588b2a50fb3fd58fc6a69a72dc8ce3609f9aef3283d883e15fcd487d57aa38f7f2e170f82b5f4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894058, "uuid": "f1ef7428-9987-4646-9348-6f549491c658", "value": "T119E34B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894058, "uuid": "1a7b9e15-03af-4efd-af3f-05ed450a38f5", "value": "3072:sqlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjX5Xa/NOL9eXgIncdVO2J:sqlhEFZBTqPoLmpMguHcUlVUHalw7Wgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894058, "uuid": "d0559972-45e9-404d-995e-fa17ba852c0f", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894058, "uuid": "59d44506-4b2f-4d9d-af09-6d2cc4b607d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894058, "uuid": "042cecb3-f5b1-41bb-959a-9b899a30ff2e", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df37c1a4-88c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756902670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902670, "uuid": "8bc74ff4-35fe-4b69-83e4-32b223d4080f", "comment": "Malware payload", "value": "db3e4b591dd6723d32f86bb6ab8d9123", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false }, { "name": "SindoorDropper", "colour": "#BB8A0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902670, "uuid": "6d21cf81-aade-4799-a12d-a4a74880f2f1", "comment": "Malware payload", "value": "9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false }, { "name": "SindoorDropper", "colour": "#BB8A0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902670, "uuid": "b39216b7-84b4-413f-b4b3-5682035bce17", "comment": "Malware payload", "value": "1ff8886aa81ebafcd454d8fb69cf55cf73a3ecf8", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false }, { "name": "SindoorDropper", "colour": "#BB8A0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902670, "uuid": "258cef92-299e-415f-9601-a0ec2ef35ba9", "comment": "Malware payload", "value": "e284b298e29ab0a2891eeb75c58fa94c9d6ac056d927eb7de99845ea2ac654e9b2467287054688dc6f894999c7ca92cd", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false }, { "name": "SindoorDropper", "colour": "#BB8A0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902670, "uuid": "988696a8-4e41-4e45-8b0b-9519feb47c57", "value": "T13B1110DF381085E19F47E0BF6B0AD48DED8B101F0E9F9469F820613724C40AA593B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902670, "uuid": "502f652c-e42e-4f13-94ed-836950052ca9", "value": "24:rd87d0B9ZC0GyFdB9vM6B9vZyFdB93hZnWK0MblHHkl7FnDn2TIr1:ra7d0B9Z2yHB9vM6B9vZyHB93hBlsFDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756902670, "uuid": "389b6662-9832-4c55-aa30-14fe53e8aa6b", "value": 991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756902670, "uuid": "1c248098-8e3c-4a46-8c09-e6401089ca78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902670, "uuid": "b6d31c39-d3f7-4c63-bc15-2b065f22d569", "value": "Note_Warfare_Ops_Sindoor.pdf.desktop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856d45fb-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756891782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891782, "uuid": "983b5d30-4001-49ac-8300-173e4e41785b", "comment": "Malware payload (RemcosRAT)", "value": "2bbfcdc97a666b7cbef4fedea9efe1e5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891782, "uuid": "19c6aa51-0a0d-4475-b20d-347dea1e0f46", "comment": "Malware payload (RemcosRAT)", "value": "9a86a6ada4acc907951a3b507a1a9bd45d70b0b3972c44ff6363f242a6669449", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891782, "uuid": "736dd912-2ad2-456e-853f-0f275b135686", "comment": "Malware payload (RemcosRAT)", "value": "864829feda34a03c363981d98901fba0e88b83fe", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891782, "uuid": "16f54a2d-588e-4912-97ec-10d2ffbd61fc", "comment": "Malware payload (RemcosRAT)", "value": "dc9a345c30a4a034c63c834c94ce5020d5e4056eb1f70b6ddb31b0d6412599a53e23e4804753355b3e998e75cb3a450f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891782, "uuid": "e005b613-81ce-4fcb-ab5f-c01010c6d54a", "value": "T1FA8512917A14C867E3B10930D8E9EB3D0BB5AC59FC8853075BE177887BF2B6DB924604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891782, "uuid": "3edc2f0f-f503-4861-b0b6-0a10de7bd409", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891782, "uuid": "15238ad0-47b1-4505-9d59-05caf3422f0b", "value": "24576:K3P2ZlpwplAR/FA/aNsHMS7RhD9ai4ulKnnrg5q9jzoH1:HpKo/FAyNsHMSlhDTLlKnnrgC341", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891782, "uuid": "cff9ea9d-1b32-4bff-ba9c-ad5d32c70297", "value": 1724656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891782, "uuid": "68ac9705-4892-4544-9190-4b201cb0795e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891782, "uuid": "c1c29b0d-60b3-4e1c-a319-8d4e89098c80", "value": "dhl doc_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dac4bc4-88bb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756899822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899822, "uuid": "829d931c-524a-4220-b36b-f57ca669afc3", "comment": "Malware payload", "value": "5f1cf070d4099eebba7b2045744fe5e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899822, "uuid": "9e45ad44-c051-4332-b053-323bd8682074", "comment": "Malware payload", "value": "9a94cd78c3cd4af08aba88a70d2fbe71d0ce7b850f369757155c85bc949534e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899822, "uuid": "c3a3cddc-f8ea-4148-9d91-5a1d0554228f", "comment": "Malware payload", "value": "d6fc8bad76de2fd79af8530878faba8ec6d73e58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899822, "uuid": "8fe06eb6-ece2-46e7-beb6-4e54e6e0d17e", "comment": "Malware payload", "value": "8cce627190c541eeb8b4c9c126a6fcef61d00f324cf777700139f530bef9123aed2674fa72c3dc518f50e6d9141185b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899822, "uuid": "d673aa72-6d35-48f8-87bd-e6b067cdd967", "value": "T18A851226E7A514FDE16FC078CD124906EB72BC4A43A0E6DF27A04E665F23AE04D3D752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899822, "uuid": "baf79ad9-9985-4934-af39-603420ce7e56", "value": "1d8915c3554f512929a8d501df563d33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899822, "uuid": "6f09c0d6-4392-438e-a44c-14b701f6e3a2", "value": "49152:Il/eF5mVISRjU+lE2CtE6uRkKaADnTaOJUW:Il/k9tjaVDOOJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899822, "uuid": "b4a801a3-8fbd-4a64-be37-a668f14fb693", "value": 1786880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899822, "uuid": "307146c8-9e70-400a-892f-fd2e5b88a568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899822, "uuid": "970bea11-9843-4970-864c-0d2ea0ee6654", "value": "output.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04e5967-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1756872097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872097, "uuid": "0d853ca8-6e09-44db-a556-861536ebf947", "comment": "Malware payload (GCleaner)", "value": "fef5c3e739660a293cd0ecea785c10e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872097, "uuid": "43f11096-7041-4d3a-bd54-f5632a5c8d2e", "comment": "Malware payload (GCleaner)", "value": "9b9a9ca1eadeef898fdd32ecc2e11d9f916793d5c07011fb40a379d2ddc01970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872097, "uuid": "a1fd5c0e-66d1-41a8-8d64-378fb45af958", "comment": "Malware payload (GCleaner)", "value": "07e31ab34183ae24b6be68af7244c4b08f56ab9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872097, "uuid": "910aab30-bc8b-47e0-ba26-35dcfb282eda", "comment": "Malware payload (GCleaner)", "value": "a2f48f2fbd9242064a892d0adc02c55d1e890bd1dcc33df37a6f627adf10536235067f210b4418a0ed1b1479e86b6163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872097, "uuid": "7b92730b-2ae3-4e55-8589-d545233c5d00", "value": "T199F5025556B0E970D3D101BCC84B3985E7D21ADF2ABB90DBECD12B4A9513F893836B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872097, "uuid": "52ebfbcf-ed4e-4cc4-a6a3-2a4f565447ec", "value": "55b6dece077975d89acf28ba84b04fcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872097, "uuid": "bbb1e764-f4e3-47e0-bea5-8f835da2f7eb", "value": "98304:4+9tXDemzYKfB2qUe004fbQhkZvYonCCa:4KXDpztfgqn4fbQhkZvYWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872097, "uuid": "00079223-d276-4cd8-acc0-f995bc15e1f5", "value": 3647264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872097, "uuid": "c30608c7-a924-4340-a370-78e1c88bce88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872097, "uuid": "f6e719de-a0f9-4fd1-8853-55ffde7f6fd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297b262c-8874-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756869294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869294, "uuid": "db115bf4-9510-4976-95b6-f78ac71d2f4d", "comment": "Malware payload (Mirai)", "value": "21f22b42e038348c22a845b81ff6721c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869294, "uuid": "39fc068d-7fd2-4ef0-9d36-8e9dbf28e171", "comment": "Malware payload (Mirai)", "value": "9b9fdeadba64fc2c4737869c6495dfa4676b5a3713ccac0f3fc941af911d8400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869294, "uuid": "e33ab2ae-0e90-409a-8837-a64e449d44bf", "comment": "Malware payload (Mirai)", "value": "066f51ca9217e81cbd809d4b9bd6d3eacdb5e0b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869294, "uuid": "0c391edd-76c1-4f89-a3f2-29bc46c09d99", "comment": "Malware payload (Mirai)", "value": "4c40ef325511f11be348fa7f499033252032ba3624aaa55f358dc5071977f3bf770a141ec9daab9a52e641e59ce9f8a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869294, "uuid": "ab97397d-02df-4737-abe9-1173d247f487", "value": "T12EB32A46BE545AEBC05ECE70052A831B11DD94DEA2F1632F717CCE8C39AD2069AD3D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869294, "uuid": "0d9cb36c-068e-4ce1-99a7-67529f3250e6", "value": "3072:wIoEzFYm2fB+SHByROLhRLOAL0WljNKZp3POJR846nggD3VYH:dBzlEB+SHoROFUAL0WljYb3POJR846n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756869294, "uuid": "9fe69878-f3f6-4464-88f5-a06ea66b3a60", "value": 110860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756869294, "uuid": "17367656-2f56-4200-9c7e-53e3561320ea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869294, "uuid": "6f34a1a4-ddde-47b5-b2ff-03ff0f57ac5a", "value": "kitty.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e681a4-88fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756927432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756927432, "uuid": "b8d6cd96-ec16-4c82-95c6-4fa682e70da2", "comment": "Malware payload (Mirai)", "value": "133b81e2e5441398ffa7493fa3c7c000", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756927432, "uuid": "5fb5e547-f28f-4d72-affa-a429aa18e5fc", "comment": "Malware payload (Mirai)", "value": "9bc04e987dd1e6aaa5a8974314b2b9eb639e81f2ac7489b67fd3d355c3573055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756927432, "uuid": "02bbd751-e174-4efc-b0f9-fec6e427d407", "comment": "Malware payload (Mirai)", "value": "54fa6b36c9f27e08bfa905081a5a9d8d5eb5b6de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756927432, "uuid": "8b809ad6-d038-4959-9f24-8c5c3e198652", "comment": "Malware payload (Mirai)", "value": "7c4892dbcd91ebd10299a38fec46de22585adf8540c58e1eb8d41bde31742bb879021ef8f1fed7ad97150b43c838a5b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756927432, "uuid": "7f11fe19-e510-46bd-af66-909a371b858e", "value": "T1F1432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756927432, "uuid": "aaa5d8e8-c8e6-42e7-9f33-3f2cdb4bf32b", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwY:RqtmZPuutfbltZFBSJsBcfDSTFI+BEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756927432, "uuid": "0331e230-ca78-4c68-a9c2-9b58dfaacf77", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756927432, "uuid": "6b81d9cd-c451-4e45-bfda-1c5d3d37455b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756927432, "uuid": "24882a91-94fd-4123-a1aa-67ed789975ef", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3ad6b8-88c1-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1756902556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902556, "uuid": "b7336d27-065e-4644-a8af-e39fa2c6747e", "comment": "Malware payload (MassLogger)", "value": "188029eb1ab18abc89805a4da974605f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902556, "uuid": "cda82f11-8e0e-4c22-a9e7-636b758287d9", "comment": "Malware payload (MassLogger)", "value": "9cc0ec6a21bd5a6623933e5d35f40cf3d5f3bc9465c0e848b6b39fe8fe1c7038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902556, "uuid": "45746760-02b5-47a0-915c-e7623a6924a9", "comment": "Malware payload (MassLogger)", "value": "4e55313987967b3de3be592a1c929aef6edcbe20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902556, "uuid": "493fa938-fd64-4385-828c-8cb16fb2e8a2", "comment": "Malware payload (MassLogger)", "value": "85d42c041f647f39a46e3c777666c69a4a934a9497ea27345fb4ab511334621ccfcc73aff84f6bb8fed6c56391e91664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902556, "uuid": "7fd4d085-45b7-450c-a78e-3e6177bbc972", "value": "T10DF4D0AC3240B59FC893C97289A4DE74AA247DBA530BC20391E71DAFB91D5D7DE101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902556, "uuid": "cb539ca9-e5b2-4505-85cc-e30fa1f2cf65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902556, "uuid": "c7688b26-bec7-4b75-8332-9bab16c0b93b", "value": "12288:9q0OW25RFrGcE1UjO2U14CcBvmthnu8sG1GjWcdbo5RsFxcJRn79s9TgVXDkF6D:9gRtEUZU17cButA8sGoj9W7sLcJzs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756902556, "uuid": "564655b7-7f89-46a3-b65d-4fe9989a6ccf", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756902556, "uuid": "23078724-0a87-4608-be4a-30e0ca7cfcc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902556, "uuid": "a6945baa-6447-4549-9618-ee15208e2cd1", "value": "SecuriteInfo.com.Win32.MalwareX-gen.86322691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533be582-88df-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756915320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915320, "uuid": "45d69412-7bfb-4831-b325-e6fada2bbf05", "comment": "Malware payload (Mirai)", "value": "997eb8c49657bef8dc91761c55e5e72d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915320, "uuid": "f3980246-ed66-472d-a92a-21503b23d054", "comment": "Malware payload (Mirai)", "value": "9d02bd002878e0ee5ed498f74b606238bc9ffcc8291fed386258e8fb241cebb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915320, "uuid": "b5b4cf29-25ea-40b4-ad2f-0dc076ccd201", "comment": "Malware payload (Mirai)", "value": "5fdda5e099ee2c5978aacbc14124972116c6369b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915320, "uuid": "00334feb-3506-436e-860c-0dda4abe8b4c", "comment": "Malware payload (Mirai)", "value": "7668ef7a63696ae014d49fe2b99ada0a58c4cd0ce179fe6c46d3c60862b8054dee4350d03ac4953d7b3c32821c165fca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915320, "uuid": "32592825-d647-4491-afa6-d7f6b2eb4aa0", "value": "T1C934C81E6E228F7EF6A9C63447B79E25976823D623E1D540E1BCC1101E6029E741FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915320, "uuid": "6465987f-eb4d-4dd0-b6a4-af9ffdbc9288", "value": "3072:/dVfjOVo57zW45eh7yIwyqulV0VNCQg+BhKClRvV/WlR6hh1+C3:lVfjOVoJK45eh7yIYe0XCkCC79/g9C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756915320, "uuid": "1dcc27bb-7e56-46f6-926f-3b7f33190761", "value": 233296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756915320, "uuid": "06f6d74b-9abc-40ac-b536-85aa60a25af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915320, "uuid": "935a6cfd-cd02-4ba0-80e3-92d3238eb51e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1a594a-88e4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756917454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756917454, "uuid": "63f24d4d-66a1-4530-909f-97c8cc556476", "comment": "Malware payload", "value": "d327a50f7c5e08f83d5dae5be6316cf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756917454, "uuid": "801753a9-5708-4058-8e44-b3e4f5711f5e", "comment": "Malware payload", "value": "9d26e35e6d36a867c6343b4f6d1d8c3c5550ea12eb0fc14427aa8d7ae6ca0a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756917454, "uuid": "c5088b45-5d46-4c03-9f39-8ed558ff22a6", "comment": "Malware payload", "value": "653f3c8bd03d97cae2cba005c01eec0df93a3e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756917454, "uuid": "fc14c888-6a5d-417c-850a-3b6c26202999", "comment": "Malware payload", "value": "f13adfd1132464f516a60995d0a42c20fe8352e55ff3cf902cb716c7257cc6eb3795703511cac6b6c10ea8a4a61b0f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756917454, "uuid": "73065b4b-5e9f-4bbc-b685-c012e12a2270", "value": "T16DE733D1243E6C8DF4EBA53BC4911039A256BC43F095D0F22A95236EFAE37AF4D816C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756917454, "uuid": "34b40bdb-4cd3-4daf-8cd1-cff26211e9a8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756917454, "uuid": "59495bd2-c5fe-48be-81f0-230c80f17203", "value": "1572864:Ee4hdV6xfq62Kw3k/ZvUz6rC8bpJiqvqk4zF6pYUaGwV:Ee4DoxfJw0WmO8lJzvGF6p3a/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756917454, "uuid": "3acc353a-0ced-4b52-a1e1-3e7e80a541b7", "value": 69087672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756917454, "uuid": "81015a4c-4ced-48ab-a67d-3eeda155c582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756917454, "uuid": "f5073d08-f979-469e-83a0-8d31827b7544", "value": "DocsSign3.1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82789efb-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1756891777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891777, "uuid": "50ed397b-4548-4ccf-b642-de74c56b4b71", "comment": "Malware payload (DarkTortilla)", "value": "39f266f658862c98aac993556950a735", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891777, "uuid": "e26ff8df-e44d-4154-ad34-71220ea603f9", "comment": "Malware payload (DarkTortilla)", "value": "9e2267735d0702b3b42f9ba72053a19931fd2c06ffd4b32f1698fdef23412a19", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891777, "uuid": "2352b193-9b7c-45bf-b149-6d96f99b6163", "comment": "Malware payload (DarkTortilla)", "value": "64b2922226bc2d09fbea8d0130fc24cb156f2ffd", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891777, "uuid": "8dfdd72a-c8a2-44cc-9386-f5e1adb03de2", "comment": "Malware payload (DarkTortilla)", "value": "9a66b254b55c152f811c64cef68945cdf7010d0a5af57d7e3d507a173435f2979ee782f4bd8aeba8eccd2cb1d1ac44bc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891777, "uuid": "a9bb81f2-61a3-4705-9ff6-f0f8c0a4fe48", "value": "T13135D02263C46F84D17EAB38B274108087F1B98AD729CA9F7DFD01CD7A62F851667613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891777, "uuid": "4a941efa-6405-44a2-af27-ab3cd5a5643c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891777, "uuid": "4ad5dad5-becf-411f-9789-0aa070b17a8d", "value": "12288:AcXeV3GZO3aqLy2q07dljps5EUmMZ8AURm2Ed1EV10EDo8CdmTSTXS8075RK2Xrv:VXK3GZOPLlP+E6vWPxoBmTkS17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891777, "uuid": "99f0fe91-2625-4568-b642-eac7c69b13c8", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891777, "uuid": "aad65962-35b9-4ffc-a672-8b8f4c36fbf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891777, "uuid": "14bb9418-f32d-4034-a13a-b2f4a5749c50", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e78562a-889a-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756885784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756885784, "uuid": "7d3e1eca-e79f-47ac-b1db-ce9f4781ddf7", "comment": "Malware payload (XWorm)", "value": "4c5842bc4dc5b5807709cfc4105e9f0a", "object_relation": "md5", "Tag": [ { "name": "45-55-67-254", "colour": "#DC8181", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756885784, "uuid": "b9972186-47eb-4e4c-9deb-0961f42452ef", "comment": "Malware payload (XWorm)", "value": "9e81ab654b7791538849e8cdbc60b170c2e8de58bc38ba5248c0a6861ee3dae7", "object_relation": "sha256", "Tag": [ { "name": "45-55-67-254", "colour": "#DC8181", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756885784, "uuid": "8119e1ab-87ca-4043-a2b5-dad9c18336db", "comment": "Malware payload (XWorm)", "value": "f249af168bb15d07942490471044ce82c940faf4", "object_relation": "sha1", "Tag": [ { "name": "45-55-67-254", "colour": "#DC8181", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756885784, "uuid": "239a617c-80a0-4b20-a607-c576fa875099", "comment": "Malware payload (XWorm)", "value": "d9e6591b53f4a41a3f9304388399c7e9c3341dbc71ce44ae0157ab28e71f04be6eea430f653f72a398a0eb1093593edd", "object_relation": "sha3-384", "Tag": [ { "name": "45-55-67-254", "colour": "#DC8181", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756885784, "uuid": "ea98adba-c971-4fa9-a34e-3cdbeaf66eb7", "value": "T15D33F3DC37E7BE0B95AD2F65727CE3942F429A0657DF160222C8E88D5572B43EAC40B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756885784, "uuid": "c6e85db6-013f-4492-abe1-bc622af274d5", "value": "384:/P71AbHiLkx+TcQgokx17u96F/48xNxg4NfHFy8H6QIm7NE8ty81dNtHdkOine9b:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756885784, "uuid": "0cf341c5-19bf-4a96-a0cc-1bd1fac4c371", "value": 51845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756885784, "uuid": "69e8053e-4a42-4e14-96b7-7814fb3b2807", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756885784, "uuid": "ceae34eb-530b-4a1a-bdb8-4afac6a0a83c", "value": "Richiedi articoli.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba57558-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929964, "uuid": "dbe33aec-502e-42e8-916a-fd21c031ce87", "comment": "Malware payload (Mirai)", "value": "2cac92d092ea48b398dd638956f44d34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929964, "uuid": "9f865809-8039-474d-9914-20796fa7ce6b", "comment": "Malware payload (Mirai)", "value": "9e8279927d21115ba56c899bbf851f9e61bf89379881942ef02b2a6e18490d64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929964, "uuid": "bb0d0e71-3149-4faf-bb07-2113370f88ac", "comment": "Malware payload (Mirai)", "value": "54504d7a46c054b9afdacc1a19564c4cc125d556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929964, "uuid": "c9fcb379-f343-48ed-b510-b7c17f3a5fb9", "comment": "Malware payload (Mirai)", "value": "a9fd972bdbe892a92fbab18cd084508a03ae1e963d805eadb29f905cfbc93bca2ed7878f27006ef7ab8a939417ca65a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929964, "uuid": "2bcce318-6c03-4240-8375-f54e938a42df", "value": "T198331981BC929902CAD42376FA2E01CD332663A9D1EF72179D216F5137DAC2F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929964, "uuid": "fc0a647a-5820-44d3-85c7-62dc62a51b35", "value": "768:h3oGCh6mppCK2t1ThNmtMGUi75dpCCDL0IIefuBJNoivikBNwoxBA1s39AJE:doGaTDC7tgUi1dMu0IIefYJSWxeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929964, "uuid": "bdc02a2f-9a48-4f86-b9fe-4113f843d2ab", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929964, "uuid": "383d33d6-b139-4329-bcaa-065245d01a91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929964, "uuid": "25e73ff7-ccf5-4f90-8e7b-974d4b119f1c", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886b6590-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756872889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872889, "uuid": "ca72f5a6-1728-4c5c-82e5-629dcb54b0d7", "comment": "Malware payload", "value": "952378bf02c242de5554ff3e6ff622b8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872889, "uuid": "7429d32d-70bf-428d-8275-568c79c2c4f1", "comment": "Malware payload", "value": "9ece9475ed92b0c57e7499f69856122750963ff404753ab0cbaf607485f1a073", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872889, "uuid": "93066605-812f-491a-80f1-db3974ad0404", "comment": "Malware payload", "value": "4d8d8903f6a2123b5050ce683e0558fcf91812e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872889, "uuid": "7c17904f-32ae-4fff-8a13-cc900f070598", "comment": "Malware payload", "value": "c60a6ee4aaf623719ba946925de80d63ea391ed5c6b4cadd3d2e1344f7d376f67593fad5799ece9e95a53db0e97eb22a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872889, "uuid": "3b52d144-c235-4f4b-a532-72c9022f4e43", "value": "T17F318D80A2A249B1BD6FA4D77B0E4C493107B5ED48C6CFB5649C75F3E18DE80B842343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872889, "uuid": "9257dd48-0cf7-48df-8f7b-014ca6378553", "value": "24:sC7ZoJyzIyox2yfyjyXWBTH6yxa1RPJyoDwybKZylyZfJyWIopSrIyRuzlUf:VWs2xDyeWtHZaXPnDVKiKJIoYrWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872889, "uuid": "493083e0-8404-4ff6-908f-01fee9622a64", "value": 1705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872889, "uuid": "256178ed-aee7-4e97-bb3e-544bf3c0b91c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872889, "uuid": "5842c4d2-5df1-44f0-a82e-110153ce735b", "value": "ftpget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7b146d-8860-11f0-91c6-42010a9c0006", "comment": "Malware payload (DiskWriter)", "timestamp": 1756860660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756860660, "uuid": "e546da04-00b0-408b-bf6b-4977b16454f1", "comment": "Malware payload (DiskWriter)", "value": "2014325212aac151e5d0cac59615047c", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756860660, "uuid": "8bbcbae1-f10a-46ec-a83d-45e2dccdcdce", "comment": "Malware payload (DiskWriter)", "value": "9f47d027f4eb8d1ca986a2e723397101d4368268285f79a95e59581794b8eca5", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756860660, "uuid": "0ce62b18-a08d-4150-821e-cf75c1aa3aaf", "comment": "Malware payload (DiskWriter)", "value": "9cd7a1436d2f5d87dd9a8dac827676a84858d616", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756860660, "uuid": "1ca36afb-2b5f-4c1e-afac-5623a7bdbb31", "comment": "Malware payload (DiskWriter)", "value": "d54c2fa64777e0c5a93a5cfd0047f1c9ea379dd9f269cc93288fd0219788a63b5084169db5792791c24af493c316dc77", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756860660, "uuid": "74a4d6b5-b49d-457f-9890-472606469018", "value": "T17CA35C01F9D194B2E4B2197218B1EE614E3DF9311F269EFB2384166A0E781D19D33EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756860660, "uuid": "119fda8e-9449-424e-8a36-9eb76cfdcc90", "value": "50f8680fb721bb0fd315ec9fbe155906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756860660, "uuid": "03e5bfc6-ac8b-47ac-a48a-3d7812b32857", "value": "1536:jfz3rvDH7//hPVFjG5zRBFgUAlahhWxZFwff5C7PS0g3zI38fKi5j4jkMCJN75s0:jfz3rvDH7/p9FjGfAa/IZCffYzFg3zIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756860660, "uuid": "c40f9023-d324-46ee-b48c-420a76f6c1b5", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756860660, "uuid": "3de70f10-0a24-4703-a8bf-034bcf5f1adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756860660, "uuid": "d8be4613-2a6e-4bb1-bb49-30549e509c67", "value": "hydrogenExtended-safety.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a2b22b-88d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756911994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911994, "uuid": "5fbdb6c2-f6ff-4141-9ff0-294b52ab0f9b", "comment": "Malware payload", "value": "c3140d2d09c609c5f2595e7289ae50c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911994, "uuid": "cf2dfa45-ccbe-40f7-800d-3998b8873d59", "comment": "Malware payload", "value": "9fb7124d1a355a73a9290333dd58e8b67ec768d3dc440f187d335881a07acdff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911994, "uuid": "651cc113-c79d-4682-890b-5e0e4eb558c2", "comment": "Malware payload", "value": "5303e07acaf2a638106a203451d01c229bb359c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756911994, "uuid": "465c26d5-2cba-4159-be08-c61b37a66667", "comment": "Malware payload", "value": "139068a0464e2bd2a752b6ed5878f36b9dc86f717c22f87f7dcad11745fc524b4ecb64b20ce8ff11c6afe97a7ab0b02a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911994, "uuid": "bec71be1-70cf-473c-ac28-98e8cee704a5", "value": "T13824A61A3A21DBFBF55C863047F38A3056D966D627E09746F25CD71C1F2028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911994, "uuid": "69e75930-c954-4ad3-a68a-0161384c4c5f", "value": "3072:+1Q1wGUuATgsiAkO9fAHLUm5YCm3cG4GxWcwc6M1:+IAugGAkOMLBm3cG4GxWcwc6M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756911994, "uuid": "f7b6fac5-6068-4138-81a4-18400427f7b4", "value": 229778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756911994, "uuid": "9bd69678-96fa-4f2b-923d-c09061b26f0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756911994, "uuid": "b886b138-5f8c-4427-92b3-25868c7f10cf", "value": "test.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730d274e-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756929976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929976, "uuid": "0e188786-fa0f-4158-8544-bc8963ee311f", "comment": "Malware payload", "value": "4692c8e17a164745b4700f8b57208f05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929976, "uuid": "ab3f3c2f-c047-4f6e-be64-613612e1e2a5", "comment": "Malware payload", "value": "a0dc3fe6e1fc5c5f564be288241de150191cad88f3c0932f4c75dddb6600cc33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929976, "uuid": "8c1c7cbf-53d8-4630-85eb-6257a00babed", "comment": "Malware payload", "value": "3d7a851158467133f40b761de4926fd2430eb3a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929976, "uuid": "570b264b-3533-4e26-b223-83061350470f", "comment": "Malware payload", "value": "725d5f1ea2040456867e04ccff7157e7f5ff2962fe6b37a706843d6753aae2aa843d7202e32449ae022d7291cf9ee3fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929976, "uuid": "a64712bb-2e33-4736-8770-faadc581f934", "value": "T1BE03E04B835F45F2DA31F436662A6E04F5B5E992B3110F4F09E897B6CCB940C9B50AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929976, "uuid": "0b1ec72a-5ca8-4613-acda-24c790c3a9ca", "value": "768:BCyROvmQjkSNDl4N8hVE8NYj/Mb5+oJ7LhjFMU2SL:kytQjkSBlZjI/G+o9EoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929976, "uuid": "d478318c-215f-4271-adc4-bde6ef1f7455", "value": 38564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929976, "uuid": "d6f93a32-47a3-47e3-ad21-20b3bc52033a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929976, "uuid": "f5a1f301-4081-4f86-9931-de435ad64b89", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf03a30-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929966, "uuid": "6803d284-049d-4752-994a-e60915ff5650", "comment": "Malware payload (Mirai)", "value": "09cd82db985765e677da575c7fe49bba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929966, "uuid": "e39a570a-5952-4046-9043-41bfe1bc081e", "comment": "Malware payload (Mirai)", "value": "a1b9cb30a56791547704895cef5c16f61e6234c9a88b848c3ae67b4395ead982", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929966, "uuid": "f1fef1e1-7737-4e3d-972e-ae21b91026d1", "comment": "Malware payload (Mirai)", "value": "3c0752a5d98992d3546455d11da097a6298d7cb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929966, "uuid": "f1b3c21e-f923-4157-8e33-33270b15340f", "comment": "Malware payload (Mirai)", "value": "89945e3a578d0f04d9ddcf5868e263c9bc3ca4cbe440cb7cc3bfd2008ac58c09a47392c5caa337fdccd79961cb02b0bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929966, "uuid": "001d3736-73e8-4941-bca4-c4f88139176e", "value": "T1CE639209BF611FF7EC6FDC374AE92B4525DD641A21A83B397930D818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929966, "uuid": "694befcd-0e7f-446d-9918-4a1d8891c1b2", "value": "768:CDScD5GY2naf8i2Sxt9yYExR15IkI5vTemle5Re5bbvuH5XiANe1j9RE:CDSC5G9afb249FKVI5fl8RWbriq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929966, "uuid": "8d611e7a-4f02-41cc-828e-67d8ac948a7b", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929966, "uuid": "37dd310b-9a91-4f3d-8ae9-b6a0d8f530ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929966, "uuid": "b2d9ecef-9b44-4de6-9f61-f100c513f5b3", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac40b73a-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913322, "uuid": "5aae39ea-aa63-44a8-a61f-a168022f4364", "comment": "Malware payload (Mirai)", "value": "529305b21ad64c0765109f9637f7f6c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913322, "uuid": "717560df-c833-42a2-8a0c-4d39777452a9", "comment": "Malware payload (Mirai)", "value": "a233727ec01cb0e068be8cd8725d0b98d3709341a436f13c9ffa883ccb18ca41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913322, "uuid": "cc55033c-2f05-4af5-b11c-4e091ade292b", "comment": "Malware payload (Mirai)", "value": "6d92067f1d60b8707b25616baeb7299e8403d7a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913322, "uuid": "12f6378c-d9e5-48a5-ac3d-7500ebd8a89c", "comment": "Malware payload (Mirai)", "value": "02230b3e57841a1599d531feef3659f066bb2abc16152fe59036dbe9d9002bf560a773028d6fc2db15ea346de7696df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913322, "uuid": "b8617ffa-cf74-4409-a7d6-1ad36af9963f", "value": "T15C431881B8819A23C5D4137AF56E56CD372523E8E2CF7217DE214F613AC681F0C6BE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913322, "uuid": "53f16a3c-2b64-452e-abbb-da1baff126d3", "value": "768:bi1YhM9243TLSqRTIrL8Bvjhp9H0LrZQIyoWjaocLVDWtuQ/Cj1mA2EDEy0eYjWO:fM9d/mL81lp90FYoW2BYuv4ZbQSlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913322, "uuid": "8bb27a5b-28ca-4e62-8723-aaf4279d97d7", "value": 56156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913322, "uuid": "fcbb9468-16fc-4078-befc-5364df88bfda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913322, "uuid": "85f30c6c-30b9-441f-a1f1-4c382117ef9f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e2505f-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1756891890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891890, "uuid": "400e0551-e061-49e9-b5e5-065289463af2", "comment": "Malware payload (AgentTesla)", "value": "f47b19612353fe904c0b80118ea463fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891890, "uuid": "07d41380-b329-4f4d-95d4-0b93b13ea7d4", "comment": "Malware payload (AgentTesla)", "value": "a31862fa3c8b010485241999d4bea4bc605687cc3f37e3653f686add5497a395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891890, "uuid": "05f6b87a-f511-4068-a415-4416523d2b67", "comment": "Malware payload (AgentTesla)", "value": "f6c60672b47e4b0edc8a5fb9623f75ed1f93f984", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891890, "uuid": "7cee1d5b-c26d-40a0-8383-50da5284bddf", "comment": "Malware payload (AgentTesla)", "value": "11c596dc40629e107d39f2f2d65db02901228f3f73eb7f189db5027c1b9fad84cdf5901d39818ea95922472987497747", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891890, "uuid": "e7a68854-192a-471e-9772-03c19c0e2433", "value": "T1705185487E81F0C11783D2C74D0E088BA666EE91941EC619B432B5E5BE5CF71CBCFA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891890, "uuid": "63f34fc9-5d53-41d4-b34e-3ca0193fbcbb", "value": "48:bsTEliazvwUtUpKKfZ4XfyxXb17wJjOc+TExHkXyOtBBFbu+5pxYiPjPNfRYLWXl:b8mzZUpKuOoxwAHuYBBNhL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891890, "uuid": "ef1d7c4d-803c-43e8-8c57-eddc95cbbd5d", "value": 2965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891890, "uuid": "d031ff9b-d9c9-40d8-9905-ae080e638ff7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891890, "uuid": "5f269af7-d620-45f8-8699-f6ba912972bc", "value": "PO_Airtronics_Trading_Sept2025.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14721c2d-887d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756873124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873124, "uuid": "11fb8b2e-b907-405b-b26b-499c347f3ed1", "comment": "Malware payload", "value": "9370d725ca8b004ebcf2f23c0f73d473", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873124, "uuid": "209ebacd-61e1-4481-8f97-8db4d9932840", "comment": "Malware payload", "value": "a4db924fa5418bdcbd22114b0bdba489b40569c4bcc256b99bcae874d8dcfbec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873124, "uuid": "edf43860-719b-437a-8596-1942e98afdb6", "comment": "Malware payload", "value": "cf4f50d82c42d466f8dec2e6c0902f35ec17b115", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873124, "uuid": "37521c02-5e0c-4bdc-a20c-2ba0d51e73fd", "comment": "Malware payload", "value": "ab92a5b12c6395242ea9e76ab58ab9ae7b88175ae803e1117ee3ce0eaa57d13e19786d401a225304f5996a731c8a236c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873124, "uuid": "148e9581-8e8f-4eb5-9785-6b4ebeeab7c5", "value": "T1D2319E9055A20971EDA994CB3B4A8C59386768FD0EC7CF7124DC32F2A1ADC40B852357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873124, "uuid": "671ff164-9f01-45a9-9343-73fb4640304d", "value": "24:sp6CZEyf6hyp69By367pynx6fkQyrL6ZLy96aNAyz6Ry369ZxyWJh86eGyRt65f:A646869S67Y68N6Zq6ab6+6xJh86eb65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756873124, "uuid": "58816555-bb40-4018-b18d-49f41c854b7c", "value": 1693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756873124, "uuid": "ee1c938b-43ac-4d60-9107-ed2411fdc704", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873124, "uuid": "5ecdb105-7b03-4f76-843a-e9a7a6088c49", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc914333-8908-11f0-91c6-42010a9c0006", "comment": "Malware payload (Nitol)", "timestamp": 1756933213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933213, "uuid": "545a94dc-6857-4d4e-a306-d2b8d3e26337", "comment": "Malware payload (Nitol)", "value": "28d953a3203a9b3c587a3ba4e0f92bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933213, "uuid": "0a84b188-35df-461d-8b46-5dd1cf625581", "comment": "Malware payload (Nitol)", "value": "a4fe410865c4277efe42382e954fe2f33fd74854662fc575f2e29cd361931f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933213, "uuid": "deeadbf9-6e69-4eb1-a733-c83a1787eb9b", "comment": "Malware payload (Nitol)", "value": "dc0a94bb380492fb543f6ed6d07919a2d43f1873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933213, "uuid": "fc355725-abdf-46fa-b2f9-5c8f46b45dce", "comment": "Malware payload (Nitol)", "value": "995623b78ca7f232942fded87a9cd52837cd7973de41fc5042b464bc79e2206774bc8e729b118636ad7355d683c64e95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933213, "uuid": "99a4ebe9-f83b-45e4-b49d-12f945277fe0", "value": "T1C2163302F2EC8420F46923708DD914D21A71BEA28B75679F1B53DD0D18B3DF9ABA0B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933213, "uuid": "5502174b-3c44-42a6-875c-cb74602d460c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933213, "uuid": "7a980bb9-98de-41b8-9691-d3643b13940f", "value": "98304:q4cKqiKroaD5i9b+eVFUbkQTRQR2i01wPfWXO9:1TY5ren8kcqd0GPfWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756933213, "uuid": "0f390699-9c05-482d-8928-b5c90c00fc1f", "value": 4195840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756933213, "uuid": "4aabd13d-be89-4784-a829-ab7d1b389ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933213, "uuid": "d522fe19-3524-4b52-8a4d-5f309f460c08", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1080f9-886b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756865516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865516, "uuid": "9018f5a0-6d37-4f07-8f36-3ed23ad61419", "comment": "Malware payload (Mirai)", "value": "582ae28a0bfe2c8c9966862a9c587a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865516, "uuid": "42517311-7637-435f-8e41-f536962dc5e2", "comment": "Malware payload (Mirai)", "value": "a7c7a4e2f42040cd94d2dc2104a93c86b2c5a83b7f113861a1184eda2752073f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865516, "uuid": "64b183ca-4d7f-4e45-b34e-461cf1be9e1c", "comment": "Malware payload (Mirai)", "value": "096a191212db3ba3d0774d8aa52cd017d87289fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865516, "uuid": "bd248c5f-ed70-4aff-9822-d0b7536115a9", "comment": "Malware payload (Mirai)", "value": "edf8d216aa6f6c5c7f5a25522724f52289c407cb390ee5b380073f2e4e9fbf1b5559cbda346b67bc957a7373fb2f011a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865516, "uuid": "4eef26ee-66a1-4529-a901-853b7c920200", "value": "T18BA35C8AF753E1F0DD4606B1112FB77D9634DE325024DE6AEB94BDB2AD32602921B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865516, "uuid": "982c2b43-cc63-43b5-9825-65855c366d99", "value": "1536:4SSSqCLkvsxa3E1jvLfXS0zzyOXz7jkSRc9p4jjggo7Uy314SkT9Str:4SiC8sI3E1nfZzzyOnDcTXiSSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756865516, "uuid": "eabd0a42-dbb4-41da-a376-438f7daf05a2", "value": 103288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756865516, "uuid": "545e9440-2a03-4d5d-9879-9ad1da34c4d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865516, "uuid": "28e8ac79-5537-4540-9a5f-3f817eb8947f", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25a5c53-888a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756879053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879053, "uuid": "f5fb5ab4-cdda-45da-bdf1-d0a341553009", "comment": "Malware payload (RemcosRAT)", "value": "fb3c2d60e6f14b58a383ae1f9dcbae96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879053, "uuid": "9f168f7c-dcb6-4aa2-b16e-c2df12254e69", "comment": "Malware payload (RemcosRAT)", "value": "a8741f2d62f81c47812fd549d14aea8d5872afb9b9788d69c6f14d5bf6fc74ac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879053, "uuid": "b05e9ad5-c2bf-4deb-a2af-dfd0e83e1048", "comment": "Malware payload (RemcosRAT)", "value": "8f11c0baceed2feae50807f9f4ee87de72979570", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879053, "uuid": "a67460ed-2b92-4652-91be-fd060a51fe8d", "comment": "Malware payload (RemcosRAT)", "value": "0ae478cc701e3b0ca791eb9d89bb08066617a1ad0242b2f28b3890fded1dffcf93bca1ee7631e68e62220fc5378a2fd0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879053, "uuid": "763ec97e-4849-4d7d-addd-c60866a71511", "value": "T1C7A5E1378C57BC4E2BDC258584CE3CD50E6E0FDB81745AD4999AF1B22289E154EEC8BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879053, "uuid": "12b187ab-8662-467d-afba-9b4bd1071ce1", "value": "24576:JPMYqg803Q4JEsEXA0rgf1lZEeg2QxCblTy8L3u9j4tVx1Mujq0kLcHwC8g3V3Rq:9zxJEsh1ZEeDB2wDmum4FQOamN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756879053, "uuid": "3a0c9268-4625-41be-adf5-32b1412d4bbc", "value": 2097504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756879053, "uuid": "d0c6778f-4863-4886-815a-2354bb1564d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879053, "uuid": "ba104351-803e-4a01-9d6e-b5e7cd903131", "value": "IMG-202508-WA0008.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d710aa-88a4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Xorbot)", "timestamp": 1756890142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890142, "uuid": "6ab3d9ec-daf8-408c-a10c-f31447f54bc6", "comment": "Malware payload (Xorbot)", "value": "623af2e9721c88133f2a4150fbc1c632", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890142, "uuid": "a06eda29-25e8-47bd-96f0-738088b02284", "comment": "Malware payload (Xorbot)", "value": "a8795ed612a2591c9f42a7531e4859f26ad52baae101d3a4880590aebdb370cc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890142, "uuid": "149eb7da-8ef2-4cf8-b3ce-4a552191d020", "comment": "Malware payload (Xorbot)", "value": "e291e9e2e9a9249039492efe86142de3fdf1b88b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890142, "uuid": "e0ec4ba6-343b-46a4-a228-197de172f9b9", "comment": "Malware payload (Xorbot)", "value": "c4b7c8236984554185645d2264185e4c86daa9656a72365c62f44ff5f385d65c0499c5b3772ec338ad3cc732197e0f48", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890142, "uuid": "e8685869-ae48-4d44-8a69-1624255c2b9c", "value": "T1B622C0C9E1F171141C8FCE443AB1A61CF27892D2B8933B35D0A568E9C68BF9CB752B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890142, "uuid": "1dca5586-c1e7-4933-bcd3-27d24366d3d4", "value": "192:9woc66ZLi+0shtLVp8Dzkq7r7Z7rrVp8Dzjhti66ZLi+r:9woc66Ri+0AVp8Dzkq7r7Z7rrVp8DzeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756890142, "uuid": "e21fb76d-b385-4bdf-b797-fedb4a6d3377", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756890142, "uuid": "77e107e2-4051-4bb7-bc2f-a5c26bc5d814", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890142, "uuid": "b966eacb-9a55-4848-b082-35abb0ba97c4", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d82c3f-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872863, "uuid": "28d2f428-fb54-451b-b7c3-0dc449f55f9e", "comment": "Malware payload (Mirai)", "value": "2d120d64c6b2c2aa2dd323725369d65e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872863, "uuid": "47a13f4d-3e0b-4f22-a35d-1b12a9b21676", "comment": "Malware payload (Mirai)", "value": "a8806e48002c4fc06ad4ce13ae364524f6da816a310faed83e57556303f1f162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872863, "uuid": "9f04760b-2bc5-4978-8d6f-e7d696755ae1", "comment": "Malware payload (Mirai)", "value": "7a7a0c38bf349518bcf1507cfa506e9e4fa10ccc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872863, "uuid": "b6d794bf-95b8-46cc-acc1-b3b32e699439", "comment": "Malware payload (Mirai)", "value": "c742f492eb85d2b432e5f7587bc442a402736a72456f571630030f17e13546351947a04b8ed6bf57ed769e53be6bfff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872863, "uuid": "b7a776bf-df5e-44c6-bae2-30fd39b4c5e3", "value": "T18B63FA8BB981CB56C4D952BAB91E51CD331317B8E3DF3313DE14AF252B8686B0A3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872863, "uuid": "c1815f30-0b5e-4b8c-bc5c-a17ff640e6dd", "value": "1536:GInghgAwdoXtaM5SP23TsVKkc6CmslJ2vL3QEM5ik+rfTBQYKfNnNm0sT:9A6Kd5SisVKkFCms9+rfTBQYoNnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872863, "uuid": "39258167-4c43-4e27-9e5a-7c49b609ac5c", "value": 71228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872863, "uuid": "1a2f2172-527e-4eea-bbc6-5a4ebf54c8fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872863, "uuid": "098606d4-5f78-4eae-b6e5-258c08e034dc", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c235d3d7-8884-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876422, "uuid": "c2f0b3d5-8940-4ea7-aeac-538228845efd", "comment": "Malware payload", "value": "99d970b2e53f7fd2043749feed21a5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876422, "uuid": "49d753de-c561-45f9-9d54-fb9515b66ef2", "comment": "Malware payload", "value": "a8c44416a50e2461e7f07a3c9377da12067636ca8cc4f8d760d542dad773a478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876422, "uuid": "adac6af5-f350-472e-a6b8-5fa03321e98a", "comment": "Malware payload", "value": "b90012676599323d466011e0d513ddf3a5aa0459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876422, "uuid": "f4e7776c-c948-43f1-8288-69586f886fb5", "comment": "Malware payload", "value": "cf46c92b724b8e0e64a8d8715f8fe804870952da75ee15899a84ad05ee280239640986fae6b06014b7b2730572cf01e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876422, "uuid": "e77ceece-3025-4584-83f0-29c4428cfb68", "value": "T1D3145C09776410B8E8779238CAA39646F7B27856077097CF13A443BD5F2B7E15A3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876422, "uuid": "2084bcf5-fdb0-4a71-ad05-67ecc3d0a756", "value": "73e37a6f9388448591cd90e21efa3322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876422, "uuid": "a3c4bde2-70ae-46b4-86dd-c895d12c55bd", "value": "3072:vG2BJzs/HXUbb6+Tzbs0vvldnffy5ZFbyYvqIUS68+rAPj3e4xBTYvp5yPCM:+Wds/2bpTf7DfU/bvqIreAjeOg5y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876422, "uuid": "b75bbcd3-4b88-41a0-8ade-58802f06d9ee", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876422, "uuid": "1a6a2b9b-6643-4f2a-8663-342ccfc21434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876422, "uuid": "540984ff-9547-4138-b241-1d094d3d99aa", "value": "dll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f729a5e-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866780, "uuid": "47353888-2d52-4feb-b1f7-02a0dae4bc6b", "comment": "Malware payload (Mirai)", "value": "acf1361f80f557ad5e09e549c19082bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866780, "uuid": "0587b990-ee52-4533-ad59-49a98a73e5c0", "comment": "Malware payload (Mirai)", "value": "a955d1defe06a8702d945793ee19ed02a098cc4a8a50cb44c4f5f82f4f152ce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866780, "uuid": "6981995a-f9ea-43df-9c40-c4f85c5985c2", "comment": "Malware payload (Mirai)", "value": "ea43fa67a0c5b5bde343453223d86fd653b9986c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866780, "uuid": "b6d5cf3a-d669-4bb1-99b8-6dcbbf49dfc7", "comment": "Malware payload (Mirai)", "value": "5a85c6c4aeee62d0777c2a5ccd64af23a0608f3750600e25918b16d699efff08ab228386a07031cc53723a1921313ad2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866780, "uuid": "1221fa68-ead2-432a-9a60-54a8d71f5eb3", "value": "T1DB932C5AE7408F13C0961775BBDF82453323DB4493AB63064A28AFF43F867AA4F76505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866780, "uuid": "acbac6e1-6133-4538-955d-67c0d8d92d57", "value": "1536:fpnB//w0307zMp+ntaqWqllDi2xIdovv3gqe4/EYzw/9MtaGjtFyM9SUGVR+EFsw:XA03uzMp+ntPsdongqN/LM/99gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866780, "uuid": "4b6bb9fe-554c-4def-b045-586d35d87624", "value": 96338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866780, "uuid": "038ca9e5-63df-4c76-ab18-df231e3d9168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866780, "uuid": "2f66de09-68bf-40a8-9d0d-4da2543e8ada", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761937d9-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866845, "uuid": "8fcd7be7-d167-4880-945d-002554258399", "comment": "Malware payload (Mirai)", "value": "cd0cac9820d81facda60e444fa758b57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866845, "uuid": "9aa31899-3e04-4e27-8c10-df79386bd692", "comment": "Malware payload (Mirai)", "value": "a9f3dc6236dee4a917c64d804c58d7241f9a92b61f80dbb4a2a3308a05078ef5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866845, "uuid": "0988553e-2985-4b7d-9782-1c74d9853d4d", "comment": "Malware payload (Mirai)", "value": "7804d1ed2fc22213688ab1d417e5c39fb49eeb78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866845, "uuid": "b3c8f09e-885d-4bac-8f1a-ee647065770f", "comment": "Malware payload (Mirai)", "value": "3acd6d68e17561ab4eccb1b6ea2c25e5dd983eb5695cf1376c0341764e453ca47cb3cf81069fc609f6d745eda8ef1a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866845, "uuid": "b270bcf4-d67b-4f7f-bcf0-74912ed109d8", "value": "T14FC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866845, "uuid": "8fead4c2-4f78-43ef-b65c-e721848fca89", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoDrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIDrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866845, "uuid": "d46697ad-7a19-4ac2-bb40-9b2827046e7c", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866845, "uuid": "35f8e4d0-bc45-4447-a413-092c4e6bc074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866845, "uuid": "a6ad562d-8aba-451f-9b94-04b4b415742f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6834b852-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929958, "uuid": "4363e0fc-bf0d-48b6-8e85-943012855937", "comment": "Malware payload (Mirai)", "value": "fb2f2c75bbe4de2fe211280a1c785a86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929958, "uuid": "f4edce06-db20-44ad-9214-703effb672be", "comment": "Malware payload (Mirai)", "value": "aa6a0e3459941e3041c87c1c2e71274b1fb6e9b6883d84c99c76a79dec427fc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929958, "uuid": "99464583-7846-435c-a85a-4cc91967fa11", "comment": "Malware payload (Mirai)", "value": "9d2da2142a4fbe6b1bce06575db466e3137b6044", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929958, "uuid": "da829a72-0796-4211-9f5a-2f07849b35a3", "comment": "Malware payload (Mirai)", "value": "e05ede87d60dbd08f049f39fd82ce6413120d739145e49583b61aaec7ac2042921db51daadbe1956da8da0724fac91d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929958, "uuid": "8ac50251-98b2-49b3-b93e-26727316d8cb", "value": "T18CB37DC8A243C0F2D45701F1613BE77B6A32D5B96119EE86E378DD31A8D3842E627B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929958, "uuid": "e825281a-89f6-4192-a517-d1c691ac01b0", "value": "1536:x6+jOEvzgu7MmBlHT8QDfpLXwf5dx0ldnuOsEZTsukaWHNSrMJMIl7mcY:xQEbPMmBdjDfpLAf5P4dntsEZIuYkfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929958, "uuid": "fc6249a8-0ac4-43c5-908a-4e0f12033f88", "value": 108936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929958, "uuid": "dfbec68e-43cb-458b-ac2d-560b5f060848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929958, "uuid": "c6eee87c-e727-4c9e-ba0a-0cd8458c1aa6", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad91235a-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913324, "uuid": "2091536d-18b0-4724-8f45-9fefff5f2cf5", "comment": "Malware payload (Mirai)", "value": "4046b5d6075c5ce38fc43d7ed99e0c31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913324, "uuid": "9f4b9f82-1cdf-4aa5-8ee0-29524ff74077", "comment": "Malware payload (Mirai)", "value": "aaef8cb3a6c95ae0d06e2dc0ba4af4cc5332c20ee943d135241ec629ca440218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913324, "uuid": "94363d9f-6e20-4c6e-84bd-dc122af1f4a5", "comment": "Malware payload (Mirai)", "value": "d23cc37e75b4073fb2b72ed1fce0849a4e99ae54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913324, "uuid": "da1064c1-0ea4-44f5-be83-e6636de3d76e", "comment": "Malware payload (Mirai)", "value": "4306b1b2edcec6a81715367911bbec5b0f2756123b7662666a16b76e4751b8b74ee9e9d471c8beb521e53f99694c9369", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913324, "uuid": "bb1d6492-c34e-4380-85c5-05db9692f6f1", "value": "T147630A96B8818F25C5D5037EF92D118E371227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913324, "uuid": "900cc63c-bb55-40bf-bbb5-e0e99adb3a73", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlcrfuscXIui8jB70w7h:VqVMkWV8PPbGjB70w7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913324, "uuid": "3d2f6692-7ba3-42b0-a674-6abf297c6cdf", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913324, "uuid": "94d3941b-260b-4345-a587-5461b425d572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913324, "uuid": "b85497ca-24e0-4119-816a-2578102def5a", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa7a907-88c2-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756902743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902743, "uuid": "6042eb51-d84b-4e88-a47f-53a033ed3ae0", "comment": "Malware payload (XWorm)", "value": "0df530f50ccfe3d7fb28dfb22aa83c8c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902743, "uuid": "725670b6-eedd-455c-8ba0-721322a11f18", "comment": "Malware payload (XWorm)", "value": "abb2f9bdd57bf8ea4e09f93845e6e72fe963832fa3a82f089031c952c7e897e0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902743, "uuid": "a046864c-fba5-4bc5-ba86-2a7c4dcc4bba", "comment": "Malware payload (XWorm)", "value": "99aa1a10b51ed1fa0abf9442195a1cd0a7d7801e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756902743, "uuid": "86a63309-8bfb-4282-957f-bcffd8a97da7", "comment": "Malware payload (XWorm)", "value": "a656dc3a4fa52d0ae795018df0cba3044a9935691b1ac1f346dbc3a00fae05cc8c4d32d957604fc92075812205e483d4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902743, "uuid": "bc37d0d2-11ba-48a2-9634-f26c51c2c5e9", "value": "T1BA4163831CCBD2240AFBC6F28578A615F40D8587B340A46D3574D9EE7A183CCD6DEA6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902743, "uuid": "4fc41c93-9c55-4437-8c19-983d31e57be6", "value": "48:ODRO0d4IfqNHJmDu6p9dUIlXeYkknQgIBzxJ6O5qtLHw6Ku8fI:Q4IfQpKLUILkcI/J6OEHRsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756902743, "uuid": "35719105-7abc-49d6-a2ff-f49ae7609dc0", "value": 2266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756902743, "uuid": "6652c2fa-dd05-4e5f-976f-72ab6089ce0d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756902743, "uuid": "e95f509a-f489-4084-90db-1c3c04580145", "value": "bill.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b659fc85-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894011, "uuid": "826d2722-2e40-4b27-882d-a42f3069f5d6", "comment": "Malware payload (Mirai)", "value": "5aa6f3635b2f72e74da4599cc929c64a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894011, "uuid": "15c462b5-a994-435c-8a64-8e10a0b00f41", "comment": "Malware payload (Mirai)", "value": "adfb9de9a74d82e9d980515498e5d02b527961d37375a76e784404d059676f85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894011, "uuid": "73c20b13-c783-406a-b3b9-5054f36782ab", "comment": "Malware payload (Mirai)", "value": "1fae0e802c72b7d3b846476b723053d671153704", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894011, "uuid": "ba2db82b-3dea-4c32-80ec-9fb45c043062", "comment": "Malware payload (Mirai)", "value": "6f4c76f13274f25a6205775c8d5a43ee3c456ad62bb9a9bcba1603d589b67f952195b2bee06a2bad910137652c571706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894011, "uuid": "2dfe9672-5f47-4029-809d-eca80fe0a45a", "value": "T12BC2E084F0458E41DFFA28F53D50DADBBB902F1EAA228E8126A053D16B5D3B71349DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894011, "uuid": "823bf6b1-de9a-423c-80ac-9d1348e8344f", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7PF5pR4uVcqgw09I:tam+AnKehPRa9aBR4u+qgw09I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894011, "uuid": "d8635a35-7ec7-4e09-81e7-800aa30db61c", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894011, "uuid": "d722a39a-68f3-4aa0-9790-a05d7724aecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894011, "uuid": "4d6daeaa-5c7a-44f4-8a0c-1658bb0f79d8", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1031639f-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872687, "uuid": "a0c2426f-c4cb-45b6-8d95-1ea0870e4935", "comment": "Malware payload (Mirai)", "value": "273f365251e142de5c1474aae396eda5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872687, "uuid": "6bc47b26-00cd-4035-b843-91cde633913a", "comment": "Malware payload (Mirai)", "value": "af484b37a7232b5cc15b01f051c47abed7f2de8f6699515d40bd48c60d15be34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872687, "uuid": "76e60d9c-06ca-42f2-9295-045098af85f4", "comment": "Malware payload (Mirai)", "value": "21e65533adb29ee0dffd5820e278b1f105b0b993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872687, "uuid": "4067b1dc-b9fd-4e48-b6a2-4334bccb3226", "comment": "Malware payload (Mirai)", "value": "3b74c6b5b22f00f3b065951cbae2904e22d11ebee260df4671e90e75edf0303c5827d637588e2c965d99a9b64637005c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872687, "uuid": "7f7d4685-5307-4430-97e8-3238d257c2a1", "value": "T18E14961E6E228F7EF26CC77047B74A34976923D627E1D684D2ACC1105F6029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872687, "uuid": "eb1150b2-5f7a-4d46-a41a-30025e34a801", "value": "3072:hwdGr9r1fu9Q5uFRjFyeY6KOlgR2714I0wkrTr9MAy4Yuq:Sd8fQ+uFryeS2W01nkb9+vuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872687, "uuid": "f28560c9-0068-4676-acf0-d1a152ef7c1d", "value": 203644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872687, "uuid": "cd9e8264-f274-42ed-b97c-d55bb2be80ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872687, "uuid": "64214fa3-406a-47fc-a070-918470be509a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9738b30-88ba-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1756899681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899681, "uuid": "6f9388e3-3553-406c-9621-7d00a9da98df", "comment": "Malware payload (SalatStealer)", "value": "f07c89ff24d2d7d2e78a8df36502ddd5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899681, "uuid": "3e6350cf-5f44-451b-8d55-384064a5391d", "comment": "Malware payload (SalatStealer)", "value": "af7707d77eee2b9a780e46c610476878e8f02ae2b16a599f081afb21d99d099b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899681, "uuid": "2e2739e1-9a09-498f-8681-dad40b88c98f", "comment": "Malware payload (SalatStealer)", "value": "a53236e89034f18b67deea4340aab2d00fdd971d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899681, "uuid": "30c73b01-8d90-4d85-9791-2a1094116fdb", "comment": "Malware payload (SalatStealer)", "value": "61a9fc951c0ac2bd90e403de830e2ed22954dd1ceeeb62ce5801c793f42c3d68ff7dde935730fcf44fb31658cdefa26a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899681, "uuid": "61c91ee1-8d18-412b-8797-284f224816e5", "value": "T196E5339F47975BDFC5C396F18F38EB2579F892A2DC908D9B50D4E3045B25BA1E802E10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899681, "uuid": "a69dc9f5-d955-44d4-b9c1-dc1959969192", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899681, "uuid": "f3042648-c5a3-44bb-827a-c45d12271807", "value": "49152:33Sysc2ZSAW8i6Y11RrGr1MQSzw8yX73R4JGxTSfMHdSujJHKw0:n0jZBFg11BGxM3w5TR40xoeSnw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899681, "uuid": "b6134149-87db-413d-95e8-e17faef167b0", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899681, "uuid": "094cb281-07db-4053-9c38-619aa9260e08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899681, "uuid": "50ebe876-8117-4d40-a84b-e76bf005cd64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bab6d89-8882-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756875391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756875391, "uuid": "63ec6e23-5be1-46f0-9e84-09b13b50aa8a", "comment": "Malware payload (Mirai)", "value": "8b3d8ac58764a21db754823d9d2b6821", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756875391, "uuid": "b08eb870-5626-41f9-866e-738ecbdb3609", "comment": "Malware payload (Mirai)", "value": "afc9b1e5af8ceb26af97bb4c3d86b44bd8fef02317916eb0ed5c429bb1019d8a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756875391, "uuid": "7f20836a-1d34-468c-960b-987095ac2719", "comment": "Malware payload (Mirai)", "value": "7b653ceefb8b2b190baefdc5c7f3c13eefc7cd74", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756875391, "uuid": "42f96b08-274e-43db-8982-93584d7bcd4b", "comment": "Malware payload (Mirai)", "value": "96f448def41151194e9285254a4a1dfc1cfa811522fecbc1cb51beac80893f44c8f1a54b27c737940ef40f8ffe931844", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756875391, "uuid": "91aa3c7f-41f0-4664-8fe5-8fac0c4d73a0", "value": "T1CB31B0C961A109A0FE65D9D73B1BCC4D300BA9DD09C6CF2568CCB9F3A08CC507482B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756875391, "uuid": "8ce23f0d-362d-4636-8cd0-b6e53561c70f", "value": "24:sH6Zakg1dC6dnDSok+AK3DhS08Yf+EZMcWVTovRD2Um:uM8s6lAjKzhSxYmJ5VTohA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756875391, "uuid": "31e52f2f-94d4-4383-af9b-c784eb59c3f9", "value": 1717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756875391, "uuid": "b4c5dffb-0eb3-410e-905b-7cabe0fca9fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756875391, "uuid": "94fffad4-3d0c-4953-8970-f76205d59caf", "value": "wget_telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a0b858-88ba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756899402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899402, "uuid": "04ba0dbe-ced8-4cc9-b574-53f829113705", "comment": "Malware payload", "value": "3a7e996eb52e3072c7e91d68be816a5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899402, "uuid": "35d2f729-3353-4003-b2db-ac22d8a1dd71", "comment": "Malware payload", "value": "b053ca276617ab5bc7b02fdd0827ac1ad79f9393b27a8bbeb00b3b476f0cfdaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899402, "uuid": "911fe8f8-78ab-4660-948c-476584c719ab", "comment": "Malware payload", "value": "9e3e71bc217e41b2afd899bcf1354c14ce1df7f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899402, "uuid": "71e873d3-1071-4d94-8be1-c0a3ef4342d7", "comment": "Malware payload", "value": "4e2ec11dc370d92c57d213f1210ef43964450f4884982e3384f65156162929b0864e29c9141ea59624c02356b74962f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899402, "uuid": "0a063acf-ba88-4cda-8063-b30efad6b9d3", "value": "T1A856BB7047F656F2E601C4B1123979FF4BF686B2A518C8DBA1852EFACC1AB8707355C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899402, "uuid": "7725930e-4fdc-47ad-8bf1-2e5c742e7372", "value": "24576:X3aOJq5bgjJKQvL5jicrCVMZPM88YMXU59SqNwB6Dsd2uqDP2Quck8n:XrJq5WruwL9MX67PUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899402, "uuid": "56799674-c102-4cb7-8cd6-6dfa6f9971f8", "value": 5968384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899402, "uuid": "f8e8356f-afcf-426c-b114-f1a6cab2fd2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899402, "uuid": "96a63186-397b-41a5-8ea5-c6c3888e9c96", "value": "b053ca276617ab5bc7b02fdd0827ac1ad79f9393b27a8bbeb00b3b476f0cfdaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0804152-8872-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756868688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868688, "uuid": "1766d167-7f36-460b-880f-f29463c50f24", "comment": "Malware payload (Mirai)", "value": "69e3de8d3a8173942bd31db121e41c7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868688, "uuid": "1422336b-2c18-4dc8-b0e0-f629a9999d2b", "comment": "Malware payload (Mirai)", "value": "b220175a3601f0ecf631a1322ee2d9b67069f6c34937048a1ce982bb0b088c20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868688, "uuid": "c12920ff-8bc3-4a8a-969e-d5aba6f21a66", "comment": "Malware payload (Mirai)", "value": "ce292ea607002f6bf92a47a172e174cd43526ac9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868688, "uuid": "fb750604-aaff-4c8e-a68c-d8597d85901b", "comment": "Malware payload (Mirai)", "value": "22398b046fda63fa2dd0b39ad8f7e9e90d333d693033fb0afec8674d3d226b05f8742b5322b58cffaa095dba7db58abb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868688, "uuid": "37b69934-192b-42ab-a9ac-b09ef676c767", "value": "T1B693C609BF614FFBE8AFCC3385B94B4524CC551622A83B727934E818F25B54F5AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868688, "uuid": "42a65d85-f5ed-472b-a927-bb300e32f218", "value": "1536:FEay0NbzXVaDfCZS5xIgaofuKSQx6rLJbZ8sXZjKfcnNm0sTz:q6nXEKkD3xObPocnNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868688, "uuid": "b505837d-d916-4a62-967a-4b4028d8ae5b", "value": 93708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868688, "uuid": "707e19e1-82a5-4a0c-ab4d-9f2993dd730d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868688, "uuid": "9e1f30b9-568c-4b31-9207-347db315255f", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56b97a9-8888-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756878145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756878145, "uuid": "93da5971-e110-463e-86e0-16b6aa4f76db", "comment": "Malware payload", "value": "1facdcd05c43ba4d37274dffc90b6d4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756878145, "uuid": "35e0d326-2f44-4bfb-bf5f-42864a151aa2", "comment": "Malware payload", "value": "b26458a0b60f4af597433fb7eff7b949ca96e59330f4e4bb85005e8bbcfa4f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756878145, "uuid": "1bd7efec-dfe8-4093-a0e1-082d8f53d6c6", "comment": "Malware payload", "value": "dc26aa1f01a3cb7c2ad487982efbcfe378d9acc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756878145, "uuid": "9ff6c8bf-9180-4dc0-b4ca-c5954f704ed8", "comment": "Malware payload", "value": "f23fe95a5b0ce2eabcc8eea40047d0a58b66523ee01993d40ffabb419d8752f240cbd831681d6a5964d083b0f2861527", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756878145, "uuid": "e2c44483-f6df-413b-8a27-2bbc77f0bfa8", "value": "T1F55633F4993746FB290283BE7711284BA3E69C25C1CE113BEBCCEB5751BD7A41828653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756878145, "uuid": "67df1b6d-b32d-4dc3-9438-da90e267547b", "value": "98304:hgf3hTppKtRv6yVWbvhXymp6e+spQRlPuyBL6Nvqk3BVY1MHuo9lcTP:hwhT/KjvZVWbv4mseilkNSaKala", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756878145, "uuid": "7f451aa0-d20e-40c3-9533-73d474c3f5e8", "value": 6266348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756878145, "uuid": "a7635dd1-7df4-499d-b381-df4346176316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756878145, "uuid": "55fa20de-bd00-485e-992f-1431a97d8b5a", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e60c07-88a5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756890311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890311, "uuid": "fb20b1d1-7688-465f-896a-05d6b3e0c65c", "comment": "Malware payload", "value": "99283a358fdb8f744d86612b9457eb7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890311, "uuid": "ab187d47-b786-44ba-b4bb-10aec1326ea3", "comment": "Malware payload", "value": "b2ca99555886133450668ed69366ffcabb9860cd5fba4340b2c1dcf7d365cfca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890311, "uuid": "8776bbe7-b16d-4d87-99c3-96856f9c135f", "comment": "Malware payload", "value": "ca7b7cdd1d35f5f626ca5e477c7047d39e7e3ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890311, "uuid": "0df60f1d-38ca-404d-a8ce-e4d6bbcaeac5", "comment": "Malware payload", "value": "30320202df8d40425f29ac067f2e00d606e7093b447052b250d139938f3c587c7e5bd136b0517bbe40a54091f5c671a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890311, "uuid": "c8c782a4-a541-4d7a-9e93-7090fef638fd", "value": "T1760512E07AD95CD6D674537C55A6E232263CFDE05A538F0B92306B360B23A827DCC687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890311, "uuid": "62dc4944-9d57-4f20-9229-98e00acc8546", "value": "ebdf3ae9da07360a5b02777664fdc105", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890311, "uuid": "a8f4c9c6-7daa-40a7-86d6-8497b0e25d27", "value": "24576:piVMwZJgfoYhoFPOnEtU5A6Xv6R9akaItotje6Uiw6:piVhJgfoY0nttPaI+jLBw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756890311, "uuid": "f524aa98-d32b-4fa7-8c75-05f81440ceb8", "value": 807522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756890311, "uuid": "f8e5038f-a678-43b1-bfa1-27b243b017b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890311, "uuid": "ab805868-8c2d-41ac-b55f-e1ef93def945", "value": "99283a358fdb8f744d86612b9457eb7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4c08c8-88bc-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1756900224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900224, "uuid": "7060adab-ec27-4d33-a228-f8b5ec55a819", "comment": "Malware payload (MassLogger)", "value": "03e410ca9dcb987d99cedf74f4ae5078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900224, "uuid": "e56cf3b0-ff9d-4159-8443-446f9d535534", "comment": "Malware payload (MassLogger)", "value": "b3117e84343f3296038c1f2bc91ae2ce0a1eef33855b535dbc0a6110c541bb6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900224, "uuid": "26e87e46-0de3-4133-a03d-8b204d9161b8", "comment": "Malware payload (MassLogger)", "value": "3d65e45d2adff4d5799502899903568728582f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900224, "uuid": "387965fe-ebd1-46c8-b3ef-ebb8490ff2f8", "comment": "Malware payload (MassLogger)", "value": "ce791877cf2fd10bc621df6a0c16f7984fe18eec84c9436e2fa1941537ab160a7d9281b61d5186cd6ec37574a5b299c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900224, "uuid": "42858619-78fd-4cf2-ad2f-69f1dacf483f", "value": "T1C2F4D09C3241B59FC853CA728D94DE74A6147CBA970BC203A1D71DABBA0DA97DF101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900224, "uuid": "2cfa1429-3173-4a88-873a-c00406490403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900224, "uuid": "57afaff1-4850-48c0-ba29-2159d6d0531e", "value": "12288:aHJ4rY0OWB1N4zngiRKvtkNbu7bBQxalFBJ44rvi2C43QC1x0sNBHa+Kpo61axNS:apW1erRc2u7t2alvHOQHQXXL6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756900224, "uuid": "9ad0a5ec-5b36-40e7-9d62-3983d7aefef6", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756900224, "uuid": "05a55df0-a8e4-457a-8f6d-1548b3353369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900224, "uuid": "a08ba131-69b7-478b-8e95-9b7b5dc1ceb2", "value": "SecuriteInfo.com.Win32.MalwareX-gen.35984659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b2185d-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929952, "uuid": "a6618738-f86b-4353-a45e-b5bc1966585b", "comment": "Malware payload (Mirai)", "value": "6cd9d02de6719dbaf3dcdc3f2c100e27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929952, "uuid": "a6a70612-c734-4af9-8dc2-28d176bfe7ef", "comment": "Malware payload (Mirai)", "value": "b391f3ae4b7b03e28f317ae80c6a949c20f623bef1a6b1d7cdce63a23cf50b29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929952, "uuid": "5acda395-47b7-4dc9-a15d-8f7aaf96a8f1", "comment": "Malware payload (Mirai)", "value": "db4b1d393f9cd8a1f405444c3ac6c713b0933440", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929952, "uuid": "dbe33317-17c6-4d7d-8380-a9035f54aa7a", "comment": "Malware payload (Mirai)", "value": "c985e47b65359ab75ba86013303517accda973d87627118954507dc5dfab78c3fbc3cbb90224b8832e0f3fa4110fc096", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929952, "uuid": "6cd15f30-584e-4a6f-a07d-37d03ad9d602", "value": "T17DE31A46EB408B13C0D62779FA9B424533239B6493EB73069928BFB43F8779E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929952, "uuid": "75c8170f-d4af-472a-af5a-f97120130043", "value": "3072:2q0It0a2bHJzQ+vUEf189gvY3m2Od68M/9cLZU:2qT0a2bHJzQQUES9QY22OdBM/9M2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929952, "uuid": "da240f94-9054-41e8-af0d-98df5e0da5fc", "value": 145050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929952, "uuid": "60093a21-a873-442b-982a-2cb8e9e699b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929952, "uuid": "2d09fbe9-ee35-4506-82a6-4f06960ff53b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979f08ad-88b8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1756898684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898684, "uuid": "d0c96715-1279-4443-a23a-7cbb1dd1f08c", "comment": "Malware payload (AsyncRAT)", "value": "eaa5bddf9537b20436922015614b31b2", "object_relation": "md5", "Tag": [ { "name": "213-14-158-35", "colour": "#5CCA9E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12656791", "colour": "#3899D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898684, "uuid": "56be2b9b-cf9f-4c41-8585-06e42a676ed2", "comment": "Malware payload (AsyncRAT)", "value": "b5a517e674d611f304c6f3ab0ab7c8e4b26a34df34bfcefdb0abb5cdabc6f37e", "object_relation": "sha256", "Tag": [ { "name": "213-14-158-35", "colour": "#5CCA9E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12656791", "colour": "#3899D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898684, "uuid": "fc732bb9-ad18-475f-8ee8-899861478db4", "comment": "Malware payload (AsyncRAT)", "value": "3374b1c60a26f93d54a220ace655782ca4704ac1", "object_relation": "sha1", "Tag": [ { "name": "213-14-158-35", "colour": "#5CCA9E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12656791", "colour": "#3899D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898684, "uuid": "4323bf09-17a6-423b-b78d-638c30c3c73b", "comment": "Malware payload (AsyncRAT)", "value": "4e74ab25bc9f552a22f04883363da57d9857b6c4d20887385dab2d5c1201e382f65f975c0860df490a7cce83ba126f88", "object_relation": "sha3-384", "Tag": [ { "name": "213-14-158-35", "colour": "#5CCA9E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12656791", "colour": "#3899D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898684, "uuid": "f5e8c0cc-042f-464f-bd19-af03169fa683", "value": "T15B535B002788C965E2AD4AF8ACF2950146B1D5772102DB5E7CC804DFAB9FFC64A537EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898684, "uuid": "c2aeda9c-f5ca-40e7-b522-675f03936fb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898684, "uuid": "728bf7e0-a9fd-4a30-a26d-e838545ca6bd", "value": "1536:shjExLDRwQuNMXbmaeWs1lheeiMl8GbbXw6duYjGpZVclN:shjExLDRwQuNMXbreFlEeFmGbbX/dazY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756898684, "uuid": "fdfb7e55-c613-4817-ae1d-7c9705409a82", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756898684, "uuid": "c604ac06-f157-4948-a40d-b6b0c167fcdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898684, "uuid": "9dd2cf28-1b64-47f9-9b9b-e3271ba8e15f", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3bfbd8-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1756891929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891929, "uuid": "e3f50bdf-1291-43e4-9ad3-bab2eccd1abf", "comment": "Malware payload (SnakeKeylogger)", "value": "42fac5bba85c29a554264a42f886413e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891929, "uuid": "f4c16a43-c218-4664-8891-23aae76032bd", "comment": "Malware payload (SnakeKeylogger)", "value": "b5c26158818ec4e36dc397d56fa75aad40737a74e5f326846534f0ba83925c44", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891929, "uuid": "a5989196-acf9-405a-824d-93e9829fc9e9", "comment": "Malware payload (SnakeKeylogger)", "value": "246ec9cbf7091028b19b9798c74d2b6f02d5aa60", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891929, "uuid": "498c1bd3-266b-4b80-86ee-67326fed838e", "comment": "Malware payload (SnakeKeylogger)", "value": "8376812c4446a6d1ad7e23f7ca887a0e4a1f6ed55256f81b61d72f976ab71d3693e25683c8d40fc5656345cf2a08f16b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891929, "uuid": "778c629f-bb6a-4261-8214-ebb8e0d22dd4", "value": "T1C0459A9D9471ADD3A054FE70E540EB978CDB438416274B121FE5A8AA6312C43FFAB3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891929, "uuid": "482486c3-0b6b-457d-b8d1-e5a98e2ba481", "value": "6144:E7qyBktHzA+45SnS3X0+KWDGVI8FRxAwKchP4pepSqdoqXoc4SfWMmE9G8ZSNk//:6qQsHY8nAK/2cs0a4qu5IE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891929, "uuid": "bb95e400-932b-4cc9-9f69-02a1beca619d", "value": 1177632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891929, "uuid": "03d31769-b21d-42d0-8439-8f3672146694", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891929, "uuid": "09cbbf09-26e7-44f2-99ad-a3ddd85634e2", "value": "vESSEL DETAIS.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b251d2-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929981, "uuid": "edb73d54-07cb-4630-900e-c1de332277d1", "comment": "Malware payload (Mirai)", "value": "7b6199ca4159b5f4d364966f83de1592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929981, "uuid": "30c8018f-5d06-44d6-8377-bc3ff42830f9", "comment": "Malware payload (Mirai)", "value": "b6545214d085f1a84a8c3e226778fb75c8debe069141450b87b9cabe64ce8633", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929981, "uuid": "2a67bdfe-5447-4ff0-b1f4-0cf1ad77ea5a", "comment": "Malware payload (Mirai)", "value": "60fac5e4f80b9f9798354edea4b139c2a2ef2ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929981, "uuid": "f310602b-8f16-40ef-90bb-8b36d032f3f7", "comment": "Malware payload (Mirai)", "value": "e9469e10fb39800aaf1cd406a1c7fa676d4abd3502c642e2ee042db60a8ef45ae89fa6c6d700796713a97497c8e70ca3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929981, "uuid": "3a4dc698-bbef-43ad-b68c-cfb063770f66", "value": "T108534A22A9792E17C0E5F57B22F38324B2F5270E24A8C66E7C720F8EFF1894055576B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929981, "uuid": "99c0e3ea-cc93-48b5-a9a1-8098ab433271", "value": "768:o7TS61owq9ng/pwRNCwYX4IBC5QPdImi2pCiiSAuO+hAl27FkZ:gTS61VSng/p2CLX4IBUQPdINchfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929981, "uuid": "83745b9e-84fc-4a74-a01b-0e143389b1e8", "value": 62508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929981, "uuid": "03a2535b-3ceb-4691-bd04-b10526bf83cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929981, "uuid": "1b1952de-87fa-4570-8359-8f197fd9d011", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5979fe-886f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756867128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867128, "uuid": "72c53c99-025d-49f1-85b8-c2d498e95717", "comment": "Malware payload (Mirai)", "value": "fde41fa38435b2968ebd9278f46fbfbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867128, "uuid": "633be449-0bbf-466c-a6ff-ded27bfcb977", "comment": "Malware payload (Mirai)", "value": "b67f7fe1169e6c6139b92f3d3daee8ba1bb19b3c1c3267f29cbbd1a4f7d09b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867128, "uuid": "6348b279-c34b-4929-bd29-46a1af2cbc58", "comment": "Malware payload (Mirai)", "value": "402e1d0a8843cfccf6373b8f9ccaeea724479c85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867128, "uuid": "3168b345-a567-4b3a-a33c-327ec6ca00e4", "comment": "Malware payload (Mirai)", "value": "c0d81a29d4c97b62b1b8c542cef5a1d307cdbf5761601fca0bb8f2badf038075b9c0bb3484912a22fcf2f9fa0f331275", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867128, "uuid": "81ffc0d0-60c6-40df-a22d-9f122bf88c2c", "value": "T12AF36B03B4D094FEC8E9C1785BAFE23ADA32B4485134761F23C46E262E9DF316B9D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867128, "uuid": "66295f3f-3fde-4af3-b28a-90660380b8bd", "value": "3072:6FmFAEHmdv5lIy81k1xcX2U9Wk6RAohFh+AOiXTorE:6owUj6OWBRlOiMrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756867128, "uuid": "5ea8d5ed-17d4-49d2-9330-899865d20ae6", "value": 164304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756867128, "uuid": "5879c01b-a638-4d02-a397-a3cba1d9a3e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867128, "uuid": "c81ae873-1152-42f7-8f61-4e3a3aab270a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e58087b-8892-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756882187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882187, "uuid": "2e27911e-ab36-46bf-b603-d1c1f2d6f6e1", "comment": "Malware payload (GuLoader)", "value": "4bfc0be4f505f1a03923fafa6da8d685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882187, "uuid": "ec03e14e-28cb-4a58-98fd-89cae8582c02", "comment": "Malware payload (GuLoader)", "value": "b7053441ee84042febef9d5c04316bd1d16c30c14b19cd9f329eeca973496107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882187, "uuid": "436e87de-bc71-4509-88ed-b8ad2e752970", "comment": "Malware payload (GuLoader)", "value": "733b58518f850c400728aa6c74b6b765a2f216f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882187, "uuid": "413c70f7-3ba0-4cfc-bf66-daea6726fcff", "comment": "Malware payload (GuLoader)", "value": "e07c3ea6290ff7724166eb4e61430a317686748a224734fc0b792c5873971420f6c38b62316b19477835af40e63714c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882187, "uuid": "10d30330-af8d-4ede-b57d-3b71e820a00c", "value": "T1ACC401977762D8E7C1F242305956E2B3866A4C3F9A61430B16E3FE7F3833270596B852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882187, "uuid": "11404534-2bd7-4b83-96eb-80aaa57e03bd", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882187, "uuid": "8091e6f4-b495-468f-9b11-9e3be1800afd", "value": "12288:BzquaEPykTd4NoQb8A5jm7FsEfoSw6VVtYCKonO:MREKk6NoQb7xm7Fw6VJnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756882187, "uuid": "9b71d8bb-fac9-4c99-bb8d-0e3f529b1ad1", "value": 557712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756882187, "uuid": "6e6fa726-17e8-42c5-b8ee-29699690edbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882187, "uuid": "eec9dcda-88fc-475a-9b87-a85e6b051ca7", "value": "Varesco_Zamowienie0902025-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195cd553-88ef-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1756922095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922095, "uuid": "091ff14d-db4e-455a-8db8-c318c0d38c42", "comment": "Malware payload (SalatStealer)", "value": "e5afe9e958150dc4be1fe2d521a44a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922095, "uuid": "0a76af21-220f-4c87-b550-d6ab7df99fe3", "comment": "Malware payload (SalatStealer)", "value": "b86b984addd013ed5d0cd5653529549b80a0dfae2552244d537b7030f915b475", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922095, "uuid": "b180a4a6-693f-4549-854d-e4ceecb359f4", "comment": "Malware payload (SalatStealer)", "value": "aec6eaa8e38f80092cba3afd807336ca05ea93fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922095, "uuid": "9268d528-5378-4bfd-b431-300dd4db9ed2", "comment": "Malware payload (SalatStealer)", "value": "77a532976d254b0159f4ed4c9ab8533bf04be41a19b9d57bdebd52ca894f52998a31459673e4c7d1c1e7b7bef2556a5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922095, "uuid": "221931e1-840d-4f84-8a49-a0619a43c3a2", "value": "T1E8A6E0DAD16E44D29C053FC9A8142AC79B2447728A7400683A7F7D898F774FEC05EEE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922095, "uuid": "03a8e7c6-9824-40bc-9b38-fb261824f314", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922095, "uuid": "21d5005c-3814-45d2-abdd-5a48b4ae277d", "value": "49152:ZrXGXUbg26e8VpBBUbrxVHg1MlyxqAdDsmIMFECFfo1rlxD2lAmA1t3pVUZ4:lGYXRpbVRDlyPDsmO4rGm0ZpG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756922095, "uuid": "e9a666cb-9674-47c2-bc82-ca819bfc4362", "value": 9869824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756922095, "uuid": "469b5500-511a-4bba-91f8-3b1e5cc49ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922095, "uuid": "002b8488-badd-4f56-852e-f3cda6c662af", "value": "e5afe9e958150dc4be1fe2d521a44a20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316b3bad-88a2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756889064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889064, "uuid": "4afbeb0e-f714-4a5c-8588-e848eb6ba54f", "comment": "Malware payload", "value": "3b918304c829ed67a4423db4d3f742eb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889064, "uuid": "3b352b90-7ad7-472e-87f2-2ea437194302", "comment": "Malware payload", "value": "b8ca6e9722532acffe1d51a5a311a5c5c0af0ff390b499237b9ea0879a2b1b5e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889064, "uuid": "951368d6-8995-4c7a-8c19-8d2fbd7d6260", "comment": "Malware payload", "value": "edcc796e85b5b6e680fa73894cdf946bba31a190", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889064, "uuid": "514d73ca-8bc1-42cb-8eaa-a113a52aec6c", "comment": "Malware payload", "value": "d39b4f6a17e9c49c29e9823902312df9ac2072ba84f95c49f046947ecc7acacad207df826bf8dfd9383f18c9d558e12f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889064, "uuid": "0120356b-6de4-45b4-8378-9d3166fb8c83", "value": "T101A63337F69E21D7F7FD8279046416E615A1199B0BF5EA640137C3B224EB8C263F2B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889064, "uuid": "7fca85e3-d3bb-4c16-849b-8881f924a8d2", "value": "196608:UpmFWiJ2snAIZzuFMcfilhw9YaRcgaGv4bfy1I3Md5HhB6gWU:U0FWkzuSYya73aGFI4Kgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756889064, "uuid": "249c7616-7563-4883-b0c9-bfc74353a00a", "value": 9899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756889064, "uuid": "b58c74c0-bb5d-4794-a590-81873afee0db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889064, "uuid": "9924aa61-7099-4b8a-90b8-fa619bb468eb", "value": "YES CREDIT CARD.APK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dafd2bf-886f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756867126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867126, "uuid": "98fd7008-a90c-4017-ad75-d58e8b5d84d4", "comment": "Malware payload (Mirai)", "value": "7214618d873b9f1d8644a48a6ffc9e27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867126, "uuid": "30b7fda7-1ba6-4f93-9b70-b9c3d24d65f7", "comment": "Malware payload (Mirai)", "value": "b8e1835879b4aeb84fcaf19d9775adb28848bc031e0634df5f092cc27136fa5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867126, "uuid": "747a1736-b179-4065-9e0c-d71fe34d63bb", "comment": "Malware payload (Mirai)", "value": "342ecbcf24e36e4e1293586c256c282ad5f2ee7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867126, "uuid": "0d83d4fe-0818-4849-852c-9c2286fdf992", "comment": "Malware payload (Mirai)", "value": "723ccc34e763b0b9ee0a4d1381f6e4b6f86cd9f6f202ef6f96d3a64f372f49af28fe20f853d42f2466818190c7ac3144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867126, "uuid": "5e158d31-99f6-4889-9ec9-1f26f313bad9", "value": "T116134C32C6B8591BC6D0A37B11A35372E0FA6BC45190574F3D690D8EFE6A340677A3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867126, "uuid": "e3384cd5-ec6e-46e5-8016-23e73e0b5171", "value": "768:1HB4kVHX/bI74jRSsAcU926+T5ipy/6zC5ceaKEtEdIO1VHMftS3FVd77DevkPb/:pjBRSs3T5iM/6zCKeD1ZTDJH4k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756867126, "uuid": "355f6e36-c94d-4ec1-98dd-30b411348193", "value": 43820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756867126, "uuid": "33a4dd25-b9f8-426b-ae90-2c15aa0c68f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867126, "uuid": "8bdce291-64b4-455a-babd-7917fcf0b067", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce797386-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894052, "uuid": "95244837-60a3-45fc-aea2-ff657ecf345c", "comment": "Malware payload (Mirai)", "value": "97bf4084352a98c14b2194264be08e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894052, "uuid": "18c7a3dd-ce37-4925-8966-9ca88ace269f", "comment": "Malware payload (Mirai)", "value": "ba4ea09ca3d1f830529d3adea723eaae36ba3465a6188e70bb70e54abbad524f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894052, "uuid": "911cf74d-595b-425f-876e-afb223290b9c", "comment": "Malware payload (Mirai)", "value": "98b46b29bb90987bcbbe0697bd6e03aa10fe06a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894052, "uuid": "dde88830-6806-4a0f-838a-99152e1795d1", "comment": "Malware payload (Mirai)", "value": "220478aa47d297e77730d161949e395ffd171cd61e494f608888393189d2b078fa8f5cbe23dcbc76d9a80f87ce8d22c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894052, "uuid": "230b9247-dab4-4069-9531-87641693728d", "value": "T14183B44D6F319F7DFBA8C73857B79A506608338A22E1D485D1ACEB060E6024E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894052, "uuid": "9df31adc-e4b8-4667-bcac-ac3dba7fd4be", "value": "1536:NYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+C:N0bY7lmZH0iL5iNl5GKjVXz3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894052, "uuid": "7bc8b471-f679-4af0-b19b-a48e01c6da2b", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894052, "uuid": "425e1bc3-e39c-4e7b-a4b0-94584a498e3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894052, "uuid": "97e352c0-29f9-467e-a06d-6e518359d30e", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461dfc65-88bc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756900266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900266, "uuid": "266a48af-472c-4abe-9bad-2b1565280613", "comment": "Malware payload", "value": "30f32f3b00798f7e678bd10731987be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900266, "uuid": "099f7570-7629-462b-9716-df427bc51636", "comment": "Malware payload", "value": "ba80b7361a74806ad71827d505e35b5bceb032c43e25e09c2504797ddcc239e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900266, "uuid": "1b3af387-7ad3-469f-8be4-15da8a91a645", "comment": "Malware payload", "value": "fa1c23d86ef6cf24c8fae49cf073e6e29e82c60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756900266, "uuid": "c8a8a250-f34e-402b-922a-fed5c8164ebf", "comment": "Malware payload", "value": "77411c4805ef39b7a849da4b047df93caceed695df0110da469377c133caa790d3496ced8e905cbea45a357fcc3733ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900266, "uuid": "16991b69-3f6b-41dd-b95d-53f9e79f775c", "value": "T167478D0AF76900F4E1679278C9534906EB72BC5A03B1D7DF13A48AA61F276D09E3EF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900266, "uuid": "8b19f491-b0dc-4456-bf03-db0d0004c59d", "value": "0c402b7c2c6ba6c4f999ffa4ecc5af87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900266, "uuid": "11bdc05d-6147-48eb-9b85-c319f1b61d6d", "value": "6144:Aa3t+Cx/3IZ6BgBu8oGLEOvZxOLl3QPr3zwDqg8hohD8AyJni:tt1lQByGLEOvGLl3aHwGhoEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756900266, "uuid": "3978e29c-0a87-4f11-b34a-8cf333cc8e86", "value": 25187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756900266, "uuid": "df1e63e1-758d-45b2-8696-2b4ff5090a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756900266, "uuid": "afc24176-bcd2-435c-b326-5b2bc5fbf23b", "value": "ScopeX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ebf078-8873-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756869175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869175, "uuid": "e869f329-4fa2-4863-b9ea-1898ab5d4037", "comment": "Malware payload (Mirai)", "value": "ed44beeb03840868b9c058852b010ace", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869175, "uuid": "14d7df50-2654-4d64-96f6-5178627b87e1", "comment": "Malware payload (Mirai)", "value": "babb20b751f9b08be37b9ec2dff9d9c38d64c0600b578bd533fc6d5ab1ee5ffe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869175, "uuid": "5c162428-39b8-41a1-9426-f4ed7d9fd51a", "comment": "Malware payload (Mirai)", "value": "d1e83bc029aaecc10b8d9b6c1214588ef36be1bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869175, "uuid": "747302ab-34ae-4ad3-ad13-914c7debfb06", "comment": "Malware payload (Mirai)", "value": "ad83dbc0416a690cbbd32ee3fddb104b9d37c37b4d0c0c141696a964954350941458e047141937375d6e48a92cd4ea9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869175, "uuid": "3b7f1f45-1dbe-4692-b9b7-e5d8ab66ab82", "value": "T1CDD209D77682C5FECA8DC1B41167A5B6C963783E13B5B28D23E0FD236A29D212D2C814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869175, "uuid": "2421cde0-9914-4b31-a0de-74e47c9824e1", "value": "384:Zmo9MO9g/5mAU2GZG6ZhX8FKbbT4Vmp1YNFkOlW2oX4bGL1CP7+ZtK3Hq/:ZmkMiIrq38FKbb0VmcHDBypCT8B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756869175, "uuid": "adb658e5-80eb-45d5-9456-d78c5a19e5b8", "value": 29664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756869175, "uuid": "702fa774-1920-4a40-b837-cb1c64e4504e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869175, "uuid": "1132326c-ef74-4e97-8ea9-45b52ee7a246", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ace1176-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872866, "uuid": "a7cc6ff2-d8ba-4636-8e0f-bbeec33136ac", "comment": "Malware payload (Mirai)", "value": "f71ef4f88ec533cccbf81dd66997fe00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872866, "uuid": "bf565d52-342a-4732-8d84-e4ad3ad5688f", "comment": "Malware payload (Mirai)", "value": "baf48d481e35adc4eb0ed13ec032b72a635365d11e595a09302c669e72684a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872866, "uuid": "203c7749-3095-4365-82c6-3d4f05f595fb", "comment": "Malware payload (Mirai)", "value": "15cad315b01450ef475f68ab3133486837f7baba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872866, "uuid": "7af86498-06cc-4931-97b5-fd1200642ecd", "comment": "Malware payload (Mirai)", "value": "8492424e30786175654caee1fac56c61c22414805a4c230ae9c8ef1f16ab311cf7baf2b8adbcc1173ee7378da662570c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872866, "uuid": "6947b0a2-960a-471e-9306-42ae9e53f2bf", "value": "T1E183F94AFD80DF56D4D921BAFE1E518D331357A8D3EA3203DE146B252BCA92B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872866, "uuid": "c6dda3a8-4091-4fb6-8650-b9f543ebe7cc", "value": "1536:ZsnLnbuBZgXtT0MasKfQZQUHoxogsycoBoQL9v3YdFU3fll8jiBkshzkKfvnNm0W:wuLy9pasSQZQUHoxwycoBoQL9v3Yd1Yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872866, "uuid": "49748f41-f9bb-4c1f-a907-39f20e4157e6", "value": 84276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872866, "uuid": "bcd236bc-9476-4cec-a648-469b11bb9e11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872866, "uuid": "ee3d5e4f-9c86-4c13-8fed-a6c04aabd26c", "value": "bot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1adeb4e-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913438, "uuid": "f9ca09bd-7730-4a70-9fa6-e6c3248d46d1", "comment": "Malware payload (Mirai)", "value": "47c18f66a49e5331fd768ab61166894a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913438, "uuid": "705f6b50-2d81-4d90-a206-b96a1cda09af", "comment": "Malware payload (Mirai)", "value": "bb726ff30dbc75167ef572d225cd9347ee63ffd906cd7639d49854fb70a2c844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913438, "uuid": "1abab8b1-e0f6-4b5d-a81e-7cb2ec7992b9", "comment": "Malware payload (Mirai)", "value": "4a2e036f7d035421ade1b437091405002776905c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913438, "uuid": "d1c6ed6d-991e-4ac3-a01c-b10f2aec09c2", "comment": "Malware payload (Mirai)", "value": "835988b908a56adb703c94ef0048b0ce2a8d2d17566ab209b0352f3d5d580e7e5bb70bdb0537de7c239b6ef1d66cc3d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913438, "uuid": "cc0458a4-82e4-49a3-9aa6-c9f22693ab4f", "value": "T15E82C07972996422C570503FCB3DCB8223D746FDA2FE773261190AF4A75248E537E982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913438, "uuid": "7be5ca93-cd18-488a-90a7-fe8c78ef0e0e", "value": "384:MEMJcxMwYgsO0WyBXLZAJgn1ax6Z1+VLAqvHEBLlxXiWtJKqhymdGUop5h56:YcRYjO0WyuJgkx6cVIVHjAqs3Uozn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913438, "uuid": "a768b8cb-961c-444f-8c15-c4ed49db4fa8", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913438, "uuid": "ceb0630e-cad7-4530-88be-af230e8a2758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913438, "uuid": "ecbcf072-df23-47e5-aa61-4f39f7d96e0b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fc9d1c-8909-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756933394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933394, "uuid": "8ba812d7-949c-45ec-9d30-afbfb4c1b61e", "comment": "Malware payload (Mirai)", "value": "80613cdec18650bd06116088dc0619e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933394, "uuid": "7a5b7711-1416-4695-be26-2b24a3e1e86b", "comment": "Malware payload (Mirai)", "value": "bb9b45b7abc8d45c47a7e245efdde63bd9e97beead746c23637536841145482e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933394, "uuid": "7ca5537e-7110-444c-a635-894f6e16686c", "comment": "Malware payload (Mirai)", "value": "8b9f165b8f03b4b0d7731a8f4d62170e3c03bd68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933394, "uuid": "71e6d69f-6916-4a5f-8150-77d59159d292", "comment": "Malware payload (Mirai)", "value": "648237c274146e1f6d082cbe8814ae05cff3e38c4bd34cf7a1e98b917483a019df36b366121a8fe1835a4857a804b217", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933394, "uuid": "55c96842-ebb5-4abe-aa4a-d493b7e790e3", "value": "T1E0519ACA51C54F302C73AE5BEAB7892C748298D294DBEFAADAD4B9E4414ED343340753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933394, "uuid": "fa9476e7-dcc8-4801-a959-d36fc7d8ab4e", "value": "48:iVc7Qc7x7/Vcvco8Vcg3cgwdVc/cYMVcJcy6Vc7Jc7y76VcfmcfHpVcAcBvVc9cx:iu757x7/u0o8ugMgwdukYMuqy6u7q7yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756933394, "uuid": "3a9f6c07-5730-4bb6-bf26-f96f21753417", "value": 2932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756933394, "uuid": "41420b2a-02f9-422f-aa8d-6b1e0c78d8db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933394, "uuid": "878e7aba-676f-4c5b-a04d-4bdc19ecfc1f", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ae769e-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872879, "uuid": "6b6b944e-e41f-4e61-ac4b-444308ec878d", "comment": "Malware payload (Mirai)", "value": "9992998f9384d75b3219e43762725e60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872879, "uuid": "2cf36524-abec-4aad-a374-5acfd3bbf6a2", "comment": "Malware payload (Mirai)", "value": "bce528f755f40d7b658b3429b4261913ee967a08eb3cdcc0318a1e6b712a4ef3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872879, "uuid": "117e3a56-e9ba-4c2b-a843-c508cc08bcb6", "comment": "Malware payload (Mirai)", "value": "38e1661cc65061081447842d7d25ff8e598b1bfc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872879, "uuid": "9512f1b0-a423-4950-af89-f8da95302eff", "comment": "Malware payload (Mirai)", "value": "6719ae5bf304ceb4ea20d49576d9eea9b80826f84d536c97afa81dfbe4b7a509205791cab0c985188c7e3b8e7ebc364b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872879, "uuid": "0d155298-87ca-4fd9-8deb-ba3c765fe253", "value": "T18A31F5C950A086B67CD89EDB359B8C1E3416F58E19C50F89EACC34FA48CCD85B052717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872879, "uuid": "ab03fc5b-a8da-4d5b-8ed3-c994cdcb91c7", "value": "24:sF+l/2rvlT/2erc/25Ad/255cFtl/2nht/22vs/2lX/2DK7/2QR/2zeO/2+:ei67OpNtpK7tSASeJUx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872879, "uuid": "054941e1-336a-4ffb-bcd4-226c82e82c2f", "value": 1560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872879, "uuid": "4deebf5a-de56-4432-8683-593d48500a63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872879, "uuid": "8331890e-afb4-41b8-9c87-4d7b138bce15", "value": "n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed545cfd-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756930181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930181, "uuid": "e79c122c-83e6-4cec-9c37-475af2b40fa6", "comment": "Malware payload (Mirai)", "value": "209e52678d85f95c6be55e62f95c8078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930181, "uuid": "87157bb7-fdec-4a17-9724-0b05cebc4335", "comment": "Malware payload (Mirai)", "value": "bd21534f8c1cb666f81d8882b1755ff63f257e578ec644eb04021329a4a77602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930181, "uuid": "ac92ec44-e2f0-4a30-80ad-1b848ef534bf", "comment": "Malware payload (Mirai)", "value": "935a279e44d1d89f9c599c42a8c7118733fbbc39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930181, "uuid": "9c44c4e3-08ca-4f95-900e-3b5a076182d4", "comment": "Malware payload (Mirai)", "value": "99fc7753ddc5ceb57cc74da3580eaf0d451a15227cc84c492858d0b728af1e85f14163979a8864d605ecbd4d867d841f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930181, "uuid": "bb40b451-0d24-42d7-9b15-a3c19d27009c", "value": "T10B338D63C42E7D94F14AC278B9204B385B23D40696833EF5A68AC6974047EDCF6593F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930181, "uuid": "c96dada6-fc71-4de9-814f-f7596f437139", "value": "768:Qe3/zTfpYtWja5FLMZaPwtACbIZXqlDohPlc7FCGFzKe174uFC9ooeQm8A0CsLtU:D3/vpY6OkaPwtA1qo3cp7dKIFuoACs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756930181, "uuid": "f44b229d-ed35-41fe-8ae1-8140e2e5944f", "value": 54700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756930181, "uuid": "06f5a182-d556-40f0-a29a-69be6ed00858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930181, "uuid": "89c68331-ae54-49e5-a653-9f6e9a2da941", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e0e74b-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880809, "uuid": "9fad4654-4b4e-49da-baba-0ddd371d87e7", "comment": "Malware payload", "value": "32d0244a6112ef788a876d75da3987e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880809, "uuid": "44c09705-0ce9-4046-b755-b41165442df3", "comment": "Malware payload", "value": "beeda555865b71a726e8086399951267323ba11d8cf3c5962e1b91f0f8caa2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880809, "uuid": "4d964c09-bdbd-4147-aba3-740b1975e65e", "comment": "Malware payload", "value": "380a289a8cb2d05c6342db1b200d4161b821945a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880809, "uuid": "daee2187-e2c9-4b2f-9fd3-49c28b21fda2", "comment": "Malware payload", "value": "efe8e326be19fe12675ec25d2b30dbf482609f16e274ac265532ca89839189aa7411ab2ab9f05b3332261aa0fbe3e9f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880809, "uuid": "ad9ceaa7-156f-4823-94db-2883f45c20f6", "value": "T108F5D082FA830083FBE345706F6989A1D4191BF77A252DDA80188684D4FDDEFD6B3527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880809, "uuid": "d684bad1-fdd8-477f-b778-a9d5bb72f3ed", "value": "6566b5de91bbc293c6eea50eb6537989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880809, "uuid": "de15791f-b5b8-43dc-b160-0d889faf5249", "value": "49152:7JE2Hsy1hoRV0AGu9hb13qwu4NpsViDA5M57mj7sAEuuhLR2h7Ozvrwv:nr4HbAOpYiDAM57awAEuupsh7Orrwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880809, "uuid": "233271d8-aa5e-4fb5-870d-337b0de51659", "value": 3449344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880809, "uuid": "2a955afa-596a-4d36-8b1b-c60d1010b9b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880809, "uuid": "b7ff8684-50ec-451c-80e3-0163910dc70e", "value": "32d0244a6112ef788a876d75da3987e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce855b8-8906-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1756932006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756932006, "uuid": "13940128-8628-461d-a691-0303c1200ad9", "comment": "Malware payload (AsyncRAT)", "value": "eda231aeeaaa67506cc277d13e683854", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756932006, "uuid": "36175c51-f2bd-4520-80c8-5bac72762d6d", "comment": "Malware payload (AsyncRAT)", "value": "bf139e8d4cc73239afcbbac7591c0fd609d2ca358ff2c4aedf991ad08f1bbe12", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756932006, "uuid": "1a076736-e1f6-4ec4-bbe1-d3d23d77916a", "comment": "Malware payload (AsyncRAT)", "value": "2b092674f6b33d55c87ebc3c11d2e3b2499ceebc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756932006, "uuid": "8843aff3-0092-4c6c-9faa-806e1455b75c", "comment": "Malware payload (AsyncRAT)", "value": "5d10a94d572ad6ea866f7ff87bd0a1398ee61d46ab72b15159d984259fcc6154a9834de153b5a95115527d4fc8faaa76", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756932006, "uuid": "7ec1674e-a415-423e-8a66-1008b3312f67", "value": "T15D232D1037E9812BE27E5FB859F26241867BF2733603D94A3CC811DB5B13BC696426ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756932006, "uuid": "ea647113-9b5b-4daa-bb66-7aa9911593b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756932006, "uuid": "59a18b3c-82dc-4bd2-a5d2-80a4161b80ec", "value": "768:so+QXMM5bJ44GnJ3DNk13wRCn1OCDyjb5gr3iId1KeOr1QMPwaClZB2tYcFmVc6K:so+QXMMR/AUVebWrSIXj61GPrBKmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756932006, "uuid": "d7e02e6f-ac81-41db-888f-7c42f31f8964", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756932006, "uuid": "48e85b06-7fbe-461f-a60a-5c8c62ede443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756932006, "uuid": "eba5c385-bf5a-4980-8281-50ec15397546", "value": "eda231aeeaaa67506cc277d13e683854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ba81fc-8872-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756868692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868692, "uuid": "2cde4958-9524-48c1-952b-20777f98405c", "comment": "Malware payload (Mirai)", "value": "2b0f0db98b1fbdf36a7910c5b5159549", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868692, "uuid": "7b67cebe-abd8-4f11-852f-5c5c96614d4c", "comment": "Malware payload (Mirai)", "value": "bfc73660150a364da12aa5bd69c4823f49b92ae68c0d13bc30558b91c18b87f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868692, "uuid": "799c4b16-e757-49d4-b785-cf226454a053", "comment": "Malware payload (Mirai)", "value": "a432bd622f5a1e6fff5d8edb29c0a30ea120f380", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868692, "uuid": "8af78c99-037b-446d-9c42-52f230faf790", "comment": "Malware payload (Mirai)", "value": "631ddaf3be55a46a1dd57a1dac038f56fcc2ca46fbde8e5de9fc3b2bcfc552187ac002dc451c67aad1b5e8e21d699236", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868692, "uuid": "fffd87ac-77f5-407c-a51d-3afc0a5bfce6", "value": "T1D073F78BBD81CB16C5C952BAB91E51CD331357A8D3DE3313DE14AF246B8A96B0A3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868692, "uuid": "9b0f1d41-1a79-4662-8d61-3f84312735b1", "value": "1536:60n5Ujd7QiuWXtVMDUukkUWv2GyslgQpvpUrsQhMiijBjZkYBKfKnNm0sT3:jM7ZTYDUuXd2GyslgQp7BjZkYBoKnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868692, "uuid": "650cae40-5feb-42df-8534-349791f9c0b1", "value": 76400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868692, "uuid": "3add7c75-5402-489d-975e-46a970ae8e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868692, "uuid": "e002e915-9c67-4365-868b-d5cdce5ed885", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4aab62-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1756891798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891798, "uuid": "16130202-def0-484a-b5fe-957e47cf7562", "comment": "Malware payload (a310Logger)", "value": "21eb3ec319eb4920ce1ad375e9ed04df", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891798, "uuid": "7498c1f1-f221-4289-8eb4-20b4ef70019a", "comment": "Malware payload (a310Logger)", "value": "bfd5c1ddd57dd2cf89518b5524ed3319502860bd876eba635985307d8042a0d1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891798, "uuid": "429b8eee-508e-4aae-88b8-5ebb0ef86f74", "comment": "Malware payload (a310Logger)", "value": "c14a2aaa08f03672bc4009f12a2f785b75583bc6", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891798, "uuid": "91448f11-5ba0-4f8e-abca-4e0884fa9fe2", "comment": "Malware payload (a310Logger)", "value": "6c7fa829e3288de698183ee69c72aacdc2d7eee0063c4b6981c528901a1a1e008a6a7fe437f484826fa3b904a982084d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891798, "uuid": "d2bd0551-61f3-4a58-8a8b-e01e3a548eda", "value": "T156E412982266CA23D6D547B11CA0E37453BD5FEE6521C3424FE9AEFB3D3671038C9292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891798, "uuid": "06b4da8c-ae32-45e4-ba66-21c4e9e9d8eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891798, "uuid": "607ec011-f427-41b4-8489-7aeeaf718ae0", "value": "12288:j0OWRkTJBTBZTQUliaQEA8Jdcomw2lb3x+1jWp9IlOcf1:KqdxzliaQEAHwCbwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891798, "uuid": "470ec203-d60b-48c6-8e50-fccb6ad7742e", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891798, "uuid": "2b7f07fb-eb46-4944-9837-4748b0a3e658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891798, "uuid": "35b79b8c-a71a-4d98-83a8-dbc28dbfea91", "value": "DhL-FINAL SHIPING DOCUMENTS987546434523#pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a26804-88b0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756895356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895356, "uuid": "733a430f-608e-48d0-a20d-b280ca4a941d", "comment": "Malware payload", "value": "b1d17040b03dcdfab8a25b42ecf1e231", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895356, "uuid": "b1b5e309-0c15-481f-9d81-51d771f030e5", "comment": "Malware payload", "value": "bfeba24c1a64046a277ffd7e23a5f5ce64f9a76a315f43b93932395ba6401fa9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895356, "uuid": "dc8ababf-2359-4f6a-a711-03fd92d40e2a", "comment": "Malware payload", "value": "2b5163e4f6f5209570904a6cfa3efd58a25bd13f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895356, "uuid": "82658277-ed77-4cf2-8f9a-9525a7bd3b90", "comment": "Malware payload", "value": "d184adfad6eb1f13353708b0f2a4000718d65e2fcc6ea89d3d93aa12ff6874ce3a256a84c738bb5810c3865256e7400e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895356, "uuid": "a3987938-b519-4c79-8177-2c2e5cac7769", "value": "T1C8B14A621506133321F634122F859C028738CA7B917257F5FBFD9599AAC52106C7FFA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895356, "uuid": "b1e5c40e-5104-45e6-a528-eebddd774e8b", "value": "96:UwH0vYgVZ+ZVU33TwtpnJWDwFR0o9hckBd+KKD8no1BfbvaqUMQ8:UwUvYgOZmct1JWDqx93ji8nojRQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756895356, "uuid": "aecce228-b1b7-4ab2-8415-936633804e5d", "value": 5134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756895356, "uuid": "c72f6ff6-d787-4fa0-87e1-4d53aab295b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895356, "uuid": "04b9c729-b6be-481d-82be-3f227e2bf010", "value": "Milieuforbrydelses.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef86fbf9-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756891960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891960, "uuid": "f7f5c766-8254-4743-a1e7-4f13691bb99f", "comment": "Malware payload", "value": "01b90b16c4506dada19f08d8393a7484", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891960, "uuid": "44701369-0baf-491e-8b2a-73cabcfe09e8", "comment": "Malware payload", "value": "c05a4445e1a684c52a4ad92bfdfc283dddaee0d0922843d1b3cc03410de611d7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891960, "uuid": "79b39a2e-8dee-43e7-986b-4e3928afe90c", "comment": "Malware payload", "value": "db84261e4de336a2146e5b7af335d8d72dca2ee4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891960, "uuid": "5074584c-4832-4d35-8b45-7b2fb9737584", "comment": "Malware payload", "value": "b59566538a590177c7036cb309b9e89e3eabd4a775e8ec8da391c2a331b584e064a5cf08932b75ef921c3e224e1e6dd9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891960, "uuid": "40dac636-30c7-41c3-b3c9-a05aca0e9ea4", "value": "T14F53C3FCB9D0073D4DD2029A9C0D3520B7796111E53142EAAE9FEEC9301B26BB676379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891960, "uuid": "6618a8ef-e4b6-4bbf-9aad-4f0457f3e614", "value": "768:LXe2jLF44LTC8sJq9YpGZy/pM1Pkd7Zuoir5m32fJc8J+jo+Csmx:LX5LF44LpckGi1PWFB+Ahkoo+Cbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891960, "uuid": "c64bcebc-142c-4613-bbd9-616b8179c064", "value": 65102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891960, "uuid": "9c6fedf0-f71a-4a66-864a-5269f0b7766a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891960, "uuid": "4ac8d660-4884-46a1-8bfd-2da11e8c3fa8", "value": "Unpaid_Duties_Report..pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3686688-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876021, "uuid": "ac88fcaf-9550-487e-920d-33916e4e6b81", "comment": "Malware payload", "value": "dbc162aa92a78068d97cd2deefb4ad55", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876021, "uuid": "0897c056-ec59-451e-a2f1-5c9936397a54", "comment": "Malware payload", "value": "c0d8d0d31350af20d0982b9da9f8274c69b16a4b04b32b77dbfa9d96fac7e86c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876021, "uuid": "cfea538a-77cb-417d-ab16-4d67f76d0ef2", "comment": "Malware payload", "value": "37ad4cd752f7de6bc560f71af36660b2efa79de2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876021, "uuid": "e1a5d237-efd3-4ca9-b015-5e6cc95f13b5", "comment": "Malware payload", "value": "8c7d3aa924f2050e42ad43cb9d54c2633c0702b427393abad7a74958f860a252bb1b173dc4bff6b17f39f24d0cc9db06", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876021, "uuid": "7998e98f-5b6f-44f6-ad55-93c7a2631d7c", "value": "T17BD2D615BB7A6DB0FF97F490A24D041479C8A1874E8B7808B41D3CFD562EEAC679902F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876021, "uuid": "585357f4-8fec-4d1a-bc1e-b05c6a55e09a", "value": "768:nzO9x5459ha/5HaM5G5r0zI3huSuBB2TJ7WTJtm9SPwfT31X13g5S47nrMz+j:zO9x63ha/laME10zI3hTIB2TJ7WTJtmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876021, "uuid": "605fc9ef-d2fb-4d7d-ab82-f3258041ea61", "value": 28543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876021, "uuid": "8047ac1c-f1e1-459a-aa80-03fca1250d4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876021, "uuid": "4188f324-6ae5-432e-b0dd-b69cbc2449e9", "value": "install_new.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fab466-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872890, "uuid": "5b5d0104-d46d-4567-b416-1aeda578dd6f", "comment": "Malware payload (Mirai)", "value": "97c2812a4d29aea92cf4e53172bf0b92", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872890, "uuid": "ab6687e0-442e-4e28-8dc9-80b54f7fb30c", "comment": "Malware payload (Mirai)", "value": "c0d9224a5b4fcc8239fff33348677e65de9d169de22b7c59148da412af7ef216", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872890, "uuid": "b28e0623-ef1a-4da7-afac-c77564b36c71", "comment": "Malware payload (Mirai)", "value": "f70502aa3e0df28baeddbcfcd69410b33979ef43", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872890, "uuid": "527abfcb-2e40-4dd5-980a-a201bdeb085b", "comment": "Malware payload (Mirai)", "value": "ef6b7d35abf786ab26acda70f7d726b193585e243ee0522187ea53448aaeeece69aced5ace1582159daf1775f8fab0ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872890, "uuid": "e4d27c8d-1421-4d27-ab7d-0d7945cb00e0", "value": "T1FF3183C950A186F53CE49E8B775B881EB116F58E1DC54F89EACC30FA588CD81B062713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872890, "uuid": "5a2f93d9-de63-4685-ab9b-fd4070b98829", "value": "24:sF+l/2rvcT/2emc/2JEAd/25Ltl/2nYt/226s/2VEX/2Dl7/2PR/2zJO/2f:eiv7JmTNsKAt5CqSVAU6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872890, "uuid": "81a3dbff-fca0-451f-a9fe-fb1434c1406e", "value": 1593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872890, "uuid": "9900c4a7-e57c-4295-ae1f-7ab0cbbef4d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872890, "uuid": "c8027fa4-b36a-4292-8e97-e8864bf9f878", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e64c534-88b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1756898910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898910, "uuid": "c922a853-ea53-45ef-a51e-784bf5595c19", "comment": "Malware payload (AsyncRAT)", "value": "f0be4843f2df9f384563da0a1705c169", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12652443", "colour": "#9DA6F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898910, "uuid": "cd7552d3-eaef-44ab-add8-35560b857d36", "comment": "Malware payload (AsyncRAT)", "value": "c1129d126820d0b83ec14389944fd8a7ade95e6a980245d37b904623183ddbf1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12652443", "colour": "#9DA6F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898910, "uuid": "a8dbaac3-b416-4d65-a393-0d02417f4d0b", "comment": "Malware payload (AsyncRAT)", "value": "f9f4a11d94dba7a47ec0f72a0eefdfe10c89775d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12652443", "colour": "#9DA6F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756898910, "uuid": "f4222204-b9aa-4165-8a7d-fe846224f760", "comment": "Malware payload (AsyncRAT)", "value": "fc7e4b91d127ad32ebf0d9129fc87b3d2233a313a77b880bf67b30c3f5e6f45404ed6cc5ec451c96aacd6143e3787ad8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12652443", "colour": "#9DA6F7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898910, "uuid": "71e7d358-f837-4e95-a0d9-067118c09a4f", "value": "T119235D4037A8C136E2FD4BB4A8F3A6058279D6572D03DA9C6CC854EA1B13BC597136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898910, "uuid": "6e9b35cb-2618-4e09-975c-84d5516f2541", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898910, "uuid": "dcb673e6-8158-4565-8cbd-afaf680cb96f", "value": "768:VOEuILWCKi+DiQyYE/pif8Yb3ge5lFtGAi4JHvEgK/J/ZVc6KN:VOtmhezbQUlXGAznkJ/ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756898910, "uuid": "de783ec0-0584-4867-ae1a-ae2ce6f30f1a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756898910, "uuid": "e2fc5019-12e2-49f9-a323-75d5da1bf694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756898910, "uuid": "a6b92ad9-ded3-42f2-bd88-04e8503f668e", "value": "comsurrogate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41adafe5-88b1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756895534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895534, "uuid": "a5375eed-b946-4519-878e-76c08d3bf584", "comment": "Malware payload", "value": "23d89f71a1429e966dc3a7f317e1e936", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895534, "uuid": "bcb7f2e3-79a5-46aa-b6a9-1548a14f9d69", "comment": "Malware payload", "value": "c184916e18f7f4e742a05d382b4f6cd94a615a6f6436cd2cac93b6812d795c7c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895534, "uuid": "f2573046-17bc-4958-b5ea-2d88b09aa8da", "comment": "Malware payload", "value": "70fb560039079b9c7db2edbd1c5683c29efed93c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895534, "uuid": "b919f04a-1879-413d-9b13-43e56cd9ec1f", "comment": "Malware payload", "value": "d52906845b0545a10f4b01d940a56f27fc7a1501338bd455aa8dc569b24d911beb4032ee3cc710d5a423c29f4f4e51db", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895534, "uuid": "cf9f5f6a-2f69-4800-a0af-07799cbc56e4", "value": "T1C1F64B16B6021328ED923CF63B26498B9F5B48BE4B425864F49637F37052BCE746DD4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895534, "uuid": "346fa761-954f-4db0-8655-7d534ad09d46", "value": "96:pW5W3QutDbnzOqvMhvFlLQeFh5Ztj6MYF47OaE/16cBr/a4HFMG1Pv4LdTe7EMez:pW5W3QCfn4DBtrVqiEPnTeiRQRhhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756895534, "uuid": "4d0a1776-53c8-4f61-9cbe-465bc6c13f47", "value": 16784242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756895534, "uuid": "8f69169d-72a1-4024-a707-1d653ee4e2df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895534, "uuid": "f7a9ab10-5ca4-4216-9ee4-23782ea09651", "value": "Outvoter86.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a310da-88df-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756915299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915299, "uuid": "2b992936-5375-4e99-9483-b563d6309ce7", "comment": "Malware payload (Mirai)", "value": "0d5356580420537b7d96d72356449cde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915299, "uuid": "82908938-0dff-4536-8d5d-dd1b7c79e2d9", "comment": "Malware payload (Mirai)", "value": "c286e3eb01f981b60e15131c9b7f94d59d2435ab3096a3f669f3f7ec0a52058d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915299, "uuid": "475da26b-879c-4a5c-bb77-0fbc594080ae", "comment": "Malware payload (Mirai)", "value": "d3185086989afda8c2ccb924313600044f494f2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915299, "uuid": "767bb2db-71ba-4fde-b2d5-927717ebdad3", "comment": "Malware payload (Mirai)", "value": "33292568b68b367db0178ae2f70d68ded39f75df7396d8e16e1326775f5005c85d02ede05ae803bba3a042e4cf313b70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915299, "uuid": "8263d204-cb5b-4d7e-998f-40ac83f8e395", "value": "T1925302F4F5D99A46FCD37F301E997ACD63A56B0982A14B42473BD7E121C622A3004FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915299, "uuid": "67e2bbaf-42d4-4b4a-8aab-62a1f25b6e04", "value": "1536:K/nWwiB11Hg1o31spMxSHpiq4u+qgw09Y:KWwib1HgO3yuxSHpT4u+qgwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756915299, "uuid": "15f9efa8-8692-4c12-8cd0-7a090fc0a837", "value": 62196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756915299, "uuid": "286d3183-4ef7-4aea-b7b4-c4ff2d45830f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915299, "uuid": "6ee07979-64c7-4d38-b250-a51801186b9a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f04f312-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872873, "uuid": "69b08a6a-f2d9-4248-a60c-b9cd6318ec0e", "comment": "Malware payload (Mirai)", "value": "a64d4371924f40468bcc6840761b9a4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872873, "uuid": "057f10da-5133-4be9-a8c4-73de99cd6bbc", "comment": "Malware payload (Mirai)", "value": "c2d0fe71a5197e56e58ca2dc8b4b6441adc50b1ad5906cc0aafc0e1ba8118cd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872873, "uuid": "9fcfbf41-d104-418e-aed3-c5165098450c", "comment": "Malware payload (Mirai)", "value": "f92e273eaeecc877008970f319353b520cd51e50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872873, "uuid": "7fef2c84-ce94-4369-b041-57bbbeaba412", "comment": "Malware payload (Mirai)", "value": "33520bd1c123fe876af048fd4f7a51353c30854094f7a7aa0e8d2d0781d2a74b916448a20598a6b79063bcb23d47b6b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872873, "uuid": "1772b966-2fc1-450e-b104-edfc20916bec", "value": "T1AE83E81E6E228FADFB6CC33547B78A35979963D623E08681D27CF9105F6024D601FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872873, "uuid": "b1e94637-b31e-412f-99e2-873b06701ba2", "value": "1536:wXZbPNClupyj5pKc1iIhXGOjcWAieptaf5UMLTJLUqajqaR8qaRitjoMUMxQ0NKY:wdMluyGOjTAZta5TJMCMxDNornNmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872873, "uuid": "a2f60fbb-3782-4cc3-ba4e-3134f60bd810", "value": 85552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872873, "uuid": "1e9135e4-6955-4f10-810a-581597fdfd50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872873, "uuid": "c12ae920-ee5b-4158-993c-3e859957034f", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaac0c1-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756891958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891958, "uuid": "d90f6a86-ecb7-4be6-823c-b3151498f279", "comment": "Malware payload (RemcosRAT)", "value": "d0113f22fc320f925738c2a0f7ca5f96", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891958, "uuid": "283cf6e7-b525-4df4-97bd-85f92bf2e2c2", "comment": "Malware payload (RemcosRAT)", "value": "c4a0f33bd3f79a4ea9ed0219d19fd905a6d559f19bf3d57c50beff226f75b225", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891958, "uuid": "7d90d088-b445-4a73-8a3a-847b96172003", "comment": "Malware payload (RemcosRAT)", "value": "843a1bd0904cb43a5eb6d29b4d349220ffd64d4b", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891958, "uuid": "39a75936-1c0a-4fa8-bfdb-8e2437c1e356", "comment": "Malware payload (RemcosRAT)", "value": "3b89ff1956253d840c79810c136f110f14240e0c7d591bd56fc2d2bb30ff4cba044e9f94315e42487d387929073d886a", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891958, "uuid": "6237ea7f-7a8a-4780-bfc1-e2c5a3c04540", "value": "T1D5C5CF5D94B05C926024FE74AAC5F793CCEA13851A174B920FE5E2A67202C43FF7B762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891958, "uuid": "1d152342-6cc2-4b7b-838c-461668101e1b", "value": "24576:dxy2wjkB9qO2XRgk6b8WzDbPFWg4IMVP0a7i4D4dFJDIoJK:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891958, "uuid": "41a37d8f-549d-49b4-bf3d-485811aa70e9", "value": 2641956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891958, "uuid": "82ce1436-d344-449b-a1e2-ebc7d0ce461a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891958, "uuid": "5edad844-306d-4e99-b456-cbbf0fc287e8", "value": "DNCP-Payment_202509021025.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce64a3b8-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880737, "uuid": "9b1af89c-eb1e-48b1-b9f7-c7b47b0229f9", "comment": "Malware payload", "value": "93beec9fa1a9a852776e5b3f84078ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880737, "uuid": "e8c16e89-b851-4f56-9a60-bb16f647971b", "comment": "Malware payload", "value": "c4d0bc93ed1e5dce2b33d1d5d433e7905664048e1bdb6d04898e688f48666b44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880737, "uuid": "fd1c1031-e98f-4dc7-85cf-46af764a516b", "comment": "Malware payload", "value": "5b8eef2601e4774e4a7d43663fea592a9aa39680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880737, "uuid": "22410fdd-af84-44c5-a028-e2d716a65c8b", "comment": "Malware payload", "value": "77f3935830ae9eb054d540199e9e15776e1d2811e1eb687e591a10f9483e08e45bb3e2633004c86b4df401f05904fb17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880737, "uuid": "7b35499f-783a-4e87-b237-dae355bfb16a", "value": "T101834A4A72E510F8C0B6813988E16A1AF7B2F4B6537157CF46B4439A1F633E09E3D722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880737, "uuid": "f6329cb1-0e9e-4e9e-92eb-a40adf63e9de", "value": "94db902678e9cc8be9117c6371afca30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880737, "uuid": "efbdb575-8d0e-4c0b-a4af-b2805a2778fd", "value": "1536:oS/ccnYADD5FTl76Lvj+P6CUPlctIgKwmtEMvftY+/mP039x6wO8P:oSEcnYaD5FTlWzifUPlc2/GM3tY+/Pxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880737, "uuid": "418c74b9-8cbf-4c98-b630-2cb7da5bd4af", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880737, "uuid": "4df5a19e-a7df-4e4b-97c6-eb150d956b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880737, "uuid": "4faec87c-9127-4985-85c7-123f4eaa6d44", "value": "93beec9fa1a9a852776e5b3f84078ceb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7008e72-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894012, "uuid": "130a1c5d-e7f5-40ef-adaa-dc5e4cb3c33a", "comment": "Malware payload (Mirai)", "value": "57ce2d6d9e92ee00cea4f536749dbef2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894012, "uuid": "e042cadb-92d1-4653-ac59-bffb5b297632", "comment": "Malware payload (Mirai)", "value": "c4fdffa36b13e3742a38317302b552e0142055d028e43ef4ccbbdbfa0b208342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894012, "uuid": "24ede0cc-ad05-461a-91e3-36769bce90e7", "comment": "Malware payload (Mirai)", "value": "7ad86eca244b54526fd7a7524f78146e69b36954", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894012, "uuid": "bb537c96-aebe-4c19-af2c-f5ce6408ffb7", "comment": "Malware payload (Mirai)", "value": "babca375793ddb75d9c819f59701046cf27dd1fab17c8a4bdd95e29c508a834729cc3a7c46157aceda4c2f2b85ada3ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894012, "uuid": "6f2c8911-4961-4bd1-aa1c-5c38204446d2", "value": "T1BCC2F1BF76995A2BFA18233DF435C11B03A4F51CA79D6B9723404432E95E42D7532CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894012, "uuid": "1cfd4872-296e-4c49-b486-cffc8ddcfc95", "value": "384:Mg1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHcNtQgL:RMwxdyoEUnDz+Y8tqHWXm8vV0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894012, "uuid": "dfa486d5-1b21-4feb-905a-d887a3a6ffb3", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894012, "uuid": "8e6ddc0c-7a6d-402e-abd1-0019f3ecf3c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894012, "uuid": "2a63443e-ec28-407f-aaa4-cda7a6e04239", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee90c43c-88a4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756890240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890240, "uuid": "847b6f7e-c40e-4f72-869a-543e284dc985", "comment": "Malware payload", "value": "b72baa66fb35df5bb4618541e81976a5", "object_relation": "md5", "Tag": [ { "name": "A4808", "colour": "#97DF1D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890240, "uuid": "ca5220ae-f3de-48c2-a496-1c0911d9c590", "comment": "Malware payload", "value": "c543a9c2ab6349444795f2493ce6b7027a3bf0b3e3d0bfdd078a291de7a7e7bd", "object_relation": "sha256", "Tag": [ { "name": "A4808", "colour": "#97DF1D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890240, "uuid": "7becb6d6-edb2-46e3-95bb-8b872b9228dd", "comment": "Malware payload", "value": "f3b3517607a8ffe9c113d419f45086e127960a0f", "object_relation": "sha1", "Tag": [ { "name": "A4808", "colour": "#97DF1D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890240, "uuid": "e00a87ff-1976-4419-9995-c7ed58fbfc0e", "comment": "Malware payload", "value": "48e8fe4f27471db4351d1ab592d2db899e3ca6b3eb7725b1b63f8c9c451dbff006cf51f5e98bf6d04ab756ac1b6e9759", "object_relation": "sha3-384", "Tag": [ { "name": "A4808", "colour": "#97DF1D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890240, "uuid": "f00c98f9-0ccc-47ea-9c53-21b37a0efa78", "value": "T1ACF3483466F50300F1F37B3CB933B75049AE754DDE2187CC00A0D61C5922E64E965B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890240, "uuid": "b99140e4-f74f-4882-809a-c66e051a98ac", "value": "12:8d/V7OlK0ocgeWVUcFYg4Scgo6LWs8XcPLL9LBniY2X0pjbgQFy/9fpDA40DLaOC:8d/V7OVg3TYgfyMPVVij4jbgQAAGOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756890240, "uuid": "61eb4cd7-a3d1-43ad-8506-ccc729a2880f", "value": 166352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756890240, "uuid": "7589611c-0cd0-4703-bf6d-262deeef4e93", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890240, "uuid": "e8666b11-0789-4907-898e-6affaf7f614f", "value": "Dodatok500.xls.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9a0cc6-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913319, "uuid": "2306115c-de11-4c98-98b4-09b63d17e6f5", "comment": "Malware payload (Mirai)", "value": "42aa4f884f2d2c15d0d834c9264ea649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913319, "uuid": "c3324733-3a44-47f8-a6b8-a4cf561c0f67", "comment": "Malware payload (Mirai)", "value": "c5bbf7e0860902e9c96eaf140e94ff8694a6c7bb37b87d1d4873a16dbfedffb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913319, "uuid": "08014d62-222c-4067-a1c0-a41240487665", "comment": "Malware payload (Mirai)", "value": "c4c0ed3ccb22f5049608e225d382ce0f9d4db4f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913319, "uuid": "b88ebd9b-d21b-4a76-9d07-ba64e5b94422", "comment": "Malware payload (Mirai)", "value": "219ffe3f25dae38b88dbddac3e8e2c389032648c7956b1b6f9d7c150c9facde85401254d6a558822ee561827f0d3e3e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913319, "uuid": "779f39be-0b97-42b1-82dc-8dbe8506c614", "value": "T1A773A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913319, "uuid": "e8fc2b31-d4b4-49d0-b51a-3dcbc3698a11", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStU:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913319, "uuid": "1c462e24-c58e-49d5-912c-a6e24f6a7e53", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913319, "uuid": "0f2d1177-055e-4e91-afe8-cfeb06b61873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913319, "uuid": "f124f33c-9a8e-4096-be42-7d9dcaf70a7c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83a6e96-88ba-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756899705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899705, "uuid": "dfc8cd75-95de-49f2-aadc-cdd0e252cd89", "comment": "Malware payload (LummaStealer)", "value": "8a7d2c2743239dbfbf3eb80367e83648", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899705, "uuid": "9ec6f77e-cb28-4f30-b324-13cbcba45e7e", "comment": "Malware payload (LummaStealer)", "value": "c5e800da0e1d523119de112aef349fb586d37e35a589be9f95e2bad81b6d8798", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899705, "uuid": "70fd6af6-9fd1-421d-9190-e935ef0b01e4", "comment": "Malware payload (LummaStealer)", "value": "0b8ebf7d35284bc1e03c7c2d3489e5f140b031e6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899705, "uuid": "a3def2a6-f089-4519-9386-bfca96541fdb", "comment": "Malware payload (LummaStealer)", "value": "fce71ead26277f3782b0076e1f8b851e57d9ca992c91d09778c406ab7c232dfb18f4d4c30da21ed86e52635a6525b591", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899705, "uuid": "44511ded-fec7-4431-89cd-2bec2698e261", "value": "T1918533661F35F4B6EACA4A300043F7057E328B93897E710FAC51663A444B3D57BFA52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899705, "uuid": "d4d52f72-46aa-418b-9379-95e273504368", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899705, "uuid": "8639a511-6b49-4832-8c05-0a5216e6f0bc", "value": "49152:pt4+pD2DXeWC6G/W669kThzAWTlj0esK:ptJD4u4G/IIh0mh0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899705, "uuid": "5ea9e665-f862-436b-9862-6eaafa95781b", "value": 1786880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899705, "uuid": "ce8f93c5-2fa6-441d-a4f5-e1128fa6fb33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899705, "uuid": "96a2d2a2-f79b-4c00-a49b-c87c5d869f77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84d21bf-8909-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756933501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933501, "uuid": "e40ae88f-8326-4e97-a93a-d7f77fb47e0d", "comment": "Malware payload (Mirai)", "value": "a60efb0786f3de76d4f67f21d5137e7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933501, "uuid": "3e0c505c-6eae-439b-81ca-4ec96d41a8f7", "comment": "Malware payload (Mirai)", "value": "c602fbda629961b9fbd1d4ab121650d6d5ee837dd1fb0ce1d699c1c7cacc280c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933501, "uuid": "0403493e-2246-4eb5-bd61-74c5f0a97f74", "comment": "Malware payload (Mirai)", "value": "ee30dd0dd798c0642c31702596cc121380ec854f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933501, "uuid": "b6c56469-f389-4225-b36b-b902f504316f", "comment": "Malware payload (Mirai)", "value": "9585e1b3f66f75f5da5655929dcc024cb93f1a50a47c62ff9e953206e9e4151a20bb7539d0cb2678c13e0022497edf9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933501, "uuid": "37f8c1fd-3311-481f-ad13-8b6bc833d3a7", "value": "T1DC53F1F1DBDDBA1363309DB52EB682C6563E9EF490E5B431AD085024C4C490ABDB9B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933501, "uuid": "a29a1d89-9566-470d-941a-e370a985b081", "value": "1536:bLAcAD/goh+4+ZeJTehXeKVczOLdpa0HEGz1P:fAj/gohffTedeKVwOLdpcGBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756933501, "uuid": "476368af-6d2a-4746-bdc1-aae9c64f68a0", "value": 62556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756933501, "uuid": "ecafa92a-e808-466c-a3f6-9c1d6c8dce8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933501, "uuid": "0598d451-4275-4ac8-9395-da344e363803", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee82be8-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929969, "uuid": "1dda7704-5ee4-43ee-8362-b7a26acf8042", "comment": "Malware payload (Mirai)", "value": "85b419cfcc7a3e808645c5225ad7a665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929969, "uuid": "c5222732-d59d-4b39-a718-c1b28305e446", "comment": "Malware payload (Mirai)", "value": "c6ffa5e5233eec8602396c555bf5e591a8a209f004efe744fecc97c231da5377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929969, "uuid": "6302e593-84fb-4677-9f9e-7365c94685c3", "comment": "Malware payload (Mirai)", "value": "1c48f08aa0e2ea5d382fbb25569dcbd73a6d4ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929969, "uuid": "728ff5ae-478e-498c-9945-91d03cb3f733", "comment": "Malware payload (Mirai)", "value": "311896ee304f214e59444fe690c04f95c9136b0ff4a75ac2cc5e5f63db6dc9bd5c1ca78b6359d78b5530107ecc227255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929969, "uuid": "2ce40fc2-9168-45cd-9f65-dde4dc53a8b5", "value": "T1EE435DD5B800DE7CFD8BEBBA81224A09F935721154A30F27A667FD93AC720564C2BD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929969, "uuid": "6d8e9f92-5879-473c-8941-8a114291db35", "value": "1536:ntCdFUWSusmecpPsjDwlKeCkRnKyQDVBqgF88y:6sjcp0eLdGBqG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929969, "uuid": "89e10b3e-ffcc-47c2-8ca1-a6584dfaea2a", "value": 59736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929969, "uuid": "6eda77c1-9229-474a-a38b-e6e7a53713a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929969, "uuid": "c7b7635e-af4e-41f2-8523-d84a46464eef", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b047df95-8885-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756876821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876821, "uuid": "6a59cf8b-a219-49a5-a512-fa8029d2dfe4", "comment": "Malware payload (XWorm)", "value": "8e08637be9083c145f3527b47a7fba81", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876821, "uuid": "b1c10d86-7415-42c1-b1b8-8a2661461caa", "comment": "Malware payload (XWorm)", "value": "c74c8dd96aa4e7310662158f9910372083379efa13ebf24e8c08bfd295b714f7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876821, "uuid": "9dd45f9e-509a-46c3-9da3-455f07223729", "comment": "Malware payload (XWorm)", "value": "e02996982087eb0a94ac2bf5f78e1b007d89316e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876821, "uuid": "6b6960e4-f0c4-41a3-8a6a-a6250d363cab", "comment": "Malware payload (XWorm)", "value": "19fedc86b0b9923913e016566058ae1a3fa28a8e9976156d8ef197609f18f587fddc44f86d9701fcd7f94a0dabfc081e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876821, "uuid": "c13e330b-0fdb-4961-93cc-9c11166ec689", "value": "T18D04B23DC7B2FCD0037E70E0A26D3B56204C2F93B6B12B6CB5D106A52855695EF7A68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876821, "uuid": "6c9fa3ca-bcdb-456b-b537-4bdd9a101e7a", "value": "3072:pIQ93xrKnDj3WvLCpJOUe89NwucXl+6RNRlklAuNlVRMYUgBie:puW2pJOUNGucXksNRWlAuNlVRMYUgBie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876821, "uuid": "1e6d557b-c697-4fb0-8d78-e0f1deda8553", "value": 184216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876821, "uuid": "3ba8d7ee-e3d9-4073-a3f8-51d1b5d2f960", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876821, "uuid": "caeeba0d-abbc-4142-b416-4b769622e253", "value": "RFQ-PO-03092025-PO2899000 INV-PAYMENT INFORMA.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8f452f-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756930180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930180, "uuid": "1974d693-e533-4959-97c6-33baceb81a45", "comment": "Malware payload (Mirai)", "value": "0b2c8b5fa88324b1992314c9c4070445", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930180, "uuid": "c4b07747-bdab-43a4-ab39-bca5d62f43ca", "comment": "Malware payload (Mirai)", "value": "c7834cbf0fd9e4926aefc20f961b369fbe65c7caa1813050d82825dd04e80c06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930180, "uuid": "a5d904c9-39f5-412b-9848-2a60759c4f0a", "comment": "Malware payload (Mirai)", "value": "974acf437ed29b2fe8079897c773c8cc310cb3c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930180, "uuid": "962c4827-e9c5-4dea-b6ae-8e9c6b516b2c", "comment": "Malware payload (Mirai)", "value": "ec74045d132b8d7fc4069e43badd83f947d980159681120d2491276fb4693e038ca95719494f8d74bce2950bd43e8087", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930180, "uuid": "42cb3c48-dd1a-4128-a413-835b0a3c9230", "value": "T11553F946FC818A11C9C513BAFE2E118D33136378E2DF72529E116F6077CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930180, "uuid": "20d6a5c7-b038-4212-a230-b79ad9486431", "value": "1536:lZntdQzsIwsKGQAwMiEJaJUapaczKxWRqVc27XqLhIFibqCxZWXJ:JSwICA5ioWUNczKxFVDuqCxZWXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756930180, "uuid": "51db6175-a151-4e30-8c25-f76f7d76c0bf", "value": 63204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756930180, "uuid": "a692b65a-bad0-4db6-ae0d-647093d681ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930180, "uuid": "265fdca3-371d-4ae4-8dcb-25c72ea95d10", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bbc1ef-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872675, "uuid": "ec64efd3-b68a-48d7-9b6f-96ea9d980a8e", "comment": "Malware payload (Mirai)", "value": "d9d02961a73f5d2d1b3dce42f7315726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872675, "uuid": "e284517f-025d-4d67-8cf7-30f90333d9cf", "comment": "Malware payload (Mirai)", "value": "c7ae30d124c770525118c3fa47204fb31b4ee0be5128da9bfa88ebc70c99bddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872675, "uuid": "51907daf-d7f0-4a08-bba8-0b1040bfa718", "comment": "Malware payload (Mirai)", "value": "167e39433d063e6b4eba6437994f6d38f0dd1384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872675, "uuid": "726e3099-d21c-40f3-ad69-57f10c5bf2e1", "comment": "Malware payload (Mirai)", "value": "910f5965637f9f6a01305d3c69999785f7a0552eab73f148a23e92f1e1395792bc00fb3dba9d0c41421cc45467da8714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872675, "uuid": "4c437a87-dede-439b-aa69-e6913a156375", "value": "T1BA41CE8A1F729EF9F45AE53847370B3927AA514847C04289E1ACDA005EC530D89DE7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872675, "uuid": "32d939ad-fe1f-4c1f-a843-e56ad7cf2440", "value": "48:Oji5E4GYg2Hyt1EYD/9LuEpEon3mGfeBl:956WHYLMEpEs3mnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872675, "uuid": "781ad060-603b-4caa-a8b4-270c19ccce4f", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872675, "uuid": "b4ce1baa-b98a-4af9-ad40-fe8d1e196403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872675, "uuid": "2d2442c0-1be3-4fef-805e-fd14f7dad739", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebdad20-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913299, "uuid": "920fa102-32e8-4094-a123-13b2ea774c90", "comment": "Malware payload (Mirai)", "value": "75b1542b6d22ec2751ebfedac5f79f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913299, "uuid": "ea0b5d3c-8443-4144-a980-f5d7432fb5f4", "comment": "Malware payload (Mirai)", "value": "c8134232868449489961522cbc0cc8a46d6c44a64e07b8a05c22fcf858db7bce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913299, "uuid": "7298f769-5578-4f66-8026-bdd92e60f6d6", "comment": "Malware payload (Mirai)", "value": "101408946c0c00c41ac16cdf86b991c377cbfdb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913299, "uuid": "f868cf4b-0dd2-4f6b-bdbf-f7b273851840", "comment": "Malware payload (Mirai)", "value": "802539553f04c9b09c4f56ce0a949488d36d9a6c18b26b863515a3dd1a9887fb61c82a5b2c861ec4a0b6b9ae8f92a4e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913299, "uuid": "ee2fb0df-3c64-45ee-a9ed-d14e59a7ca1a", "value": "T155A2E019FF1C858BC8322A3941DAE9C621A1EC31F3ACDD5A5A94C46FB5A33D56034F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913299, "uuid": "7e23b5fe-d356-4f5d-9621-cd6e13ac85ff", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXa2UbDib+502F2vwA9B1fKVVXBtmSY:x98o08kxofBE+ZkXaXDibp2F2n8VVX7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913299, "uuid": "93451a0a-ce0f-401c-82d9-4f9b3963ca74", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913299, "uuid": "f282cb7f-4eda-43f3-a317-2d33f6aa506d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913299, "uuid": "07915cad-9d11-4064-af7f-f20e44332d9a", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c145bcf7-886b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756865683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865683, "uuid": "1a5d3207-781b-4bac-8aa7-d828dc474805", "comment": "Malware payload (Mirai)", "value": "1c023aacdf6132302886f9ab2d18bac1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865683, "uuid": "6889d968-9ce4-4707-84cc-e022184d0c39", "comment": "Malware payload (Mirai)", "value": "c8393ef6fa63cb5e8df05f72037b6505bf7f5591fee32881a84c5fa639fc3da5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865683, "uuid": "d45a670a-389c-4d2d-885f-c60a5c478b83", "comment": "Malware payload (Mirai)", "value": "bd887732af6872b319cde27ce91003d337db3b59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865683, "uuid": "63332696-b1dc-4ba0-8048-59cbc0962c06", "comment": "Malware payload (Mirai)", "value": "a06a5dba5e6849e8371de28db19f565cf3122411cf9b0898f7310aa925604b1160b094975a36a7892f8cc5c809e66d0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865683, "uuid": "2038c78c-4ce6-466b-9484-538538b6f825", "value": "T134F33B06770D0943E2632EF43B3B27D1D3DFEA9121F4E644251FAA8A9172D36158ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865683, "uuid": "9dc4d22f-523d-4758-8363-80ec016872ae", "value": "3072:I/9u1tRKgYHvxuotnqTVeAlu2cPOCX/+/:I/9u1t4vxxtqTVegZYHXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756865683, "uuid": "3d509037-2c04-4dbd-bcaa-10491fc0aa41", "value": 159148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756865683, "uuid": "ae87bacb-6161-41b8-a753-ec5851b9046d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865683, "uuid": "6ea29bf2-05d4-4d87-a6b4-2a3daeea483b", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ed2d02-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756891870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891870, "uuid": "411792c5-f415-4075-a8fe-6c2039a0df26", "comment": "Malware payload", "value": "65d491f50be1fdb5952a107a5ba7ee30", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891870, "uuid": "c53f155b-3d4f-4c8c-b9cc-06c0065f682b", "comment": "Malware payload", "value": "c83f645369bd6c84db6f1750f895037077647323d811b61b15f34f2ab4f18292", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891870, "uuid": "1ba00cd8-b4b2-4c02-86ac-a1682ebff628", "comment": "Malware payload", "value": "5cd59dbf56405a55a4eec5ce4196902f38773b1e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891870, "uuid": "031dc3e4-69e0-4585-9f61-3eacaefe2043", "comment": "Malware payload", "value": "138078fd38e3eb8713e1dd8f6f6a83e18de3fa62fd664c522cb8b6d93b293c5df591e7307d8326f454cf1d4b28db47a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891870, "uuid": "188b9d16-8df6-4c8b-852e-d481f3c11587", "value": "T19D13B7C1FAA3FB776A9B00E1884EBB7DD8AF93342B0DA54E1044DAAC9444C35D2DF654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891870, "uuid": "b3e4106b-5aa7-4052-b9ed-172a2af99f41", "value": "192:DU5F5LrhkeFA+WqmR3EBrR1b6SDBP5kJPRw9Gwm9+45DH:45F5LtFjWq+3EBvv0PRw9Gb9TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891870, "uuid": "156a7790-7286-45d9-910d-55ba4183f2f8", "value": 45055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891870, "uuid": "5509aba4-fa15-4d36-94b2-9d05faed5a1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891870, "uuid": "e648755b-64d0-4325-a316-1e571b83bdec", "value": "Purchase order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea070865-8893-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756882931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882931, "uuid": "1b40484c-21b1-4a31-a27a-4b62239abd98", "comment": "Malware payload (GuLoader)", "value": "888fadc0c11ca8e23e8126b42f96f45e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882931, "uuid": "e0f02c83-95d3-4f49-a545-958b9c0febf8", "comment": "Malware payload (GuLoader)", "value": "c86a9e96f6dc66ebcc40b7d400a8d72edd6ad00baf7e0b3e5bbe033b28384512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882931, "uuid": "5e04df4f-cfa1-42fc-9203-b3adc781f9e1", "comment": "Malware payload (GuLoader)", "value": "3a43bb1ac315d7b3337d35f85f51e9376425198a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882931, "uuid": "c207b5f7-016e-4d51-b3e2-19abb695a16c", "comment": "Malware payload (GuLoader)", "value": "132c5ce2f37cde1e7da719870e44c6171c14588154b1a0287ed618ab1bf8bbe960da43742fd2967519486d39d4f4f85a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882931, "uuid": "67e02b47-af03-42fc-8ad2-7040203fa15e", "value": "T1F0B402D67705CB13CC83733909A1EA791676DFF59712CA81AA343B29BCA3B511C252D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882931, "uuid": "013f51d9-e44d-4b7d-9cb1-493706907a01", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882931, "uuid": "19dcc7df-8a00-4b2b-a91d-1f0113ef6a55", "value": "6144:ybE/HU4UABKb5lzXUY94g2eldCmvye5fJik4IU8xCnqlcTe5dgJSBP6gcWs/INXu:ybbXUY9FP75srvqQescBRb6I1e1RlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756882931, "uuid": "54d2572f-bfab-4962-afa8-aa98cd9d5e28", "value": 541480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756882931, "uuid": "8ff054c8-569a-4146-ab09-53f0fa1fb819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882931, "uuid": "1844df1b-637e-4229-922f-6c403700048b", "value": "order9590596986096996986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13976491-88ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1756894168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894168, "uuid": "4c453f0b-4a5e-4fb8-b4ce-1e7a321e0e74", "comment": "Malware payload (PhantomStealer)", "value": "43fc54ef8c19e5dff8e99f8c6c5cf0b0", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894168, "uuid": "ba70cc90-d7d9-448e-8cc3-caef6eb40570", "comment": "Malware payload (PhantomStealer)", "value": "c892c8668ba311e2d29d127f2baec94afd6ac1308afa9a977c6d7a6eae5623bc", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894168, "uuid": "dac72048-7ebc-4012-88e5-26d1554218cc", "comment": "Malware payload (PhantomStealer)", "value": "04db2518266cf31613605297bd6c44e7658f296d", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894168, "uuid": "1aa26ffc-5d26-49f6-a180-70dfad31298b", "comment": "Malware payload (PhantomStealer)", "value": "6f853ee07bd735dfb9430f14ad53f2196b6398cbc750a0c0f9f6c5db644440a8e66057e8f28e50a0215673beb530169d", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894168, "uuid": "3591e20b-0957-4dd0-8eaa-bba6adac5735", "value": "T1D8A2D164CA1B756E917A5E1C3841B9819CDFF1EF0287D4820FCF94858A9D1EA7CA28B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894168, "uuid": "75a1465d-f442-439e-8ca1-73031f5ebf9d", "value": "384:bNqY9CJ9cDC34EPaafU9Ujkb4SS5QQc8jn3KyzA1I2IKC4/7866U6VOnW0AwP5yZ:JqiDC3eas6QbVSQJ66CA1I2IKCM78U6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894168, "uuid": "261cde91-5bb8-4c7e-a978-c2ece9b66d3f", "value": 22906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894168, "uuid": "0ec417b5-67a0-4765-8229-ca9bfdfce7a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894168, "uuid": "a7415b2d-832d-4abe-afdf-4f000e8c3d95", "value": "RFQ-200KRFx 4000209650.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fdcf83-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872677, "uuid": "ca723f2f-3b05-4c52-ac99-70c44bf102b2", "comment": "Malware payload (Mirai)", "value": "23145ce1ed8c2867b78fd61ab80a3618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872677, "uuid": "5746ed34-a5d2-43ec-83fb-9176e4f4a836", "comment": "Malware payload (Mirai)", "value": "c8993c8ad7f81b7b40b38580f0f9682c988530de21dd9defae90def2eab896d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872677, "uuid": "98df3c4b-8d92-4471-b9c2-695da53bb516", "comment": "Malware payload (Mirai)", "value": "82ae873a7f371979cb1d48d779aff72c62ff32b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872677, "uuid": "56d665f2-1282-403b-a729-212a4cde6683", "comment": "Malware payload (Mirai)", "value": "e08f5c2797aea135c1c067bf48416cb9f509429f1825167298172a44365afbf334a7767a03cdfcd3457bce3254313e6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872677, "uuid": "ce46b8fa-68e9-4ea3-97bc-9258544e2047", "value": "T13631F1D1A7D05DBDC8E451BEAE6B431473789F80F0C63923821C77186D1EF786D26485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872677, "uuid": "b925eaeb-e4e6-40a1-af61-427a3cef9c9b", "value": "24:uAlKGpa7Urz/jlfLnXK1hcVev3gRGH9i1BBuLlfx9gSO:uAlKGpa7UrLZYnz2BuJx9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872677, "uuid": "fd1f90a7-4883-4cf2-a088-b515edc58365", "value": 1492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872677, "uuid": "967716f8-c3ab-4faf-aeb1-1798d35743b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872677, "uuid": "3349789c-929b-41b1-a5cb-b46325141dbc", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d634fc6-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866777, "uuid": "3312f572-e50d-41e0-a858-5a796ebf278b", "comment": "Malware payload (Mirai)", "value": "f0e7966dba94fd1c29b6c391fc765696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866777, "uuid": "ca5f1e79-13e7-4edd-ba20-d94de3d3555e", "comment": "Malware payload (Mirai)", "value": "c8f631ddb964beacbd8a6c45eae64931b41d9121ce218cb8432ae65d5f76751b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866777, "uuid": "36b19a54-742c-49d9-aad8-a2d1f0008f87", "comment": "Malware payload (Mirai)", "value": "8f2e80b7c198f7adce34933f3d499de58ce5912c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866777, "uuid": "cff2b003-f05a-4928-a174-20290ce6c089", "comment": "Malware payload (Mirai)", "value": "9faf0c2787d3014baaef8d1bf3602455910b3bf8801711fe9eb867b560080b3dad9f9968ca0ad558323a01e091f93ac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866777, "uuid": "c16aa1f6-5df7-4a17-b0c2-370d691866a9", "value": "T151C2D0E07726FE31C420AC3DE52B4D893A51067C91FF393664658C398EC169B67F84A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866777, "uuid": "2cf287a2-9b1e-425d-ba6b-eae306a27717", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwr89q3UELu7:OKy4qfqoeJdXWgFLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866777, "uuid": "05780b41-2940-49d1-89c3-0723ba3b86be", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866777, "uuid": "9aef21cc-aaa6-49b8-8c8c-d4fcba7a0242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866777, "uuid": "99bb0954-6154-412a-9436-9b34611d1158", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a85c5b-88f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1756923538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923538, "uuid": "2e35d0df-9224-4d9b-8b09-ba6a99018bae", "comment": "Malware payload (VIPKeylogger)", "value": "28485e92124a53aef5700265ad0bc658", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923538, "uuid": "6ca3acca-f442-4ebe-b90e-e48616f38d8f", "comment": "Malware payload (VIPKeylogger)", "value": "c91ec090e5c0dabc75c3cbdb355555550eac59ec33e2e9cd156c246fce325775", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923538, "uuid": "de21ddb4-53c4-406a-8d36-f347542b540c", "comment": "Malware payload (VIPKeylogger)", "value": "44832fefc8ca3c5b4793ddfe7d6e85010c54a149", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923538, "uuid": "86ba6d91-2000-4d6b-85cf-9f1c9035b7b1", "comment": "Malware payload (VIPKeylogger)", "value": "92cc03b258098dcd2f685495d67fad8a5d58b8f6200c110bb62b5c972fdbc7817135b0ea1a5247b7be1d23bf4b16cb66", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923538, "uuid": "e8613ef0-a78b-4930-b152-d468cc8f8fb8", "value": "T1D35523027A04A7B5EF3746317C2E0F181B967D3EE890629F27F8B26A78F1572469F150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923538, "uuid": "85aad6de-a4d3-4260-9ca9-e21d24d1d248", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923538, "uuid": "5a3277dc-2dce-48a5-902b-8590d593db8f", "value": "24576:q6GRbNQthbKFCOu+B+GTT/dAULOC66v00sqI9RpE56VWOCDK5WG:MbubKFCIs6GpP6psVbW54CWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923538, "uuid": "9adb33a3-5291-48d2-8ab4-b9f8a396d69b", "value": 1291800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923538, "uuid": "af8e2285-966a-471d-82f6-734407fd8d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923538, "uuid": "eb55bc5b-4464-4fb1-a539-c87d5ea73322", "value": "DHL Express Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bb1c6e-8871-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756868215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868215, "uuid": "d79a0f95-e6a8-4041-ab5b-3f2453090e6b", "comment": "Malware payload (Mirai)", "value": "499917d8386fc58ee6989f11c1235e91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868215, "uuid": "a73f5142-816b-4f8c-b6c3-a0c44e22edf3", "comment": "Malware payload (Mirai)", "value": "c9328f788c095471ba7ba4a9bf702bcda6e5e7d20119da8db261279bd1333211", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868215, "uuid": "28b7d0f5-4eca-4963-ba34-64e758663b3f", "comment": "Malware payload (Mirai)", "value": "97e6c33f38e0971575c79cb3fe8e5e5e2ddc61aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868215, "uuid": "e23ee4e2-d493-4931-aa78-fab28e15ab39", "comment": "Malware payload (Mirai)", "value": "0cdd242b8556c44304aa03de1f97b77a4449966a7fc7a6a99b7730bef213af7bc3d560a19f37f312665b03f8daa8cdc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868215, "uuid": "9576dd74-35ba-4d0a-9a17-561e762487d5", "value": "T1170419C7FD00DEFAF81AE33748530809B130B7A254925A377257356FED3A195186BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868215, "uuid": "82a90c0f-513a-4b35-84a3-e1872b5f56fa", "value": "3072:yfY4dI0pVCLKJZZ7TstbfiwycHeaK7xO704CiqdwPVVpjbivL5GTeKag:ywTLKZylyc+aK7E7NAwPWLgSKag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868215, "uuid": "84f477e7-dbd5-4589-8787-57fb9d12d08f", "value": 182468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868215, "uuid": "9f2489bd-eba3-4e49-b670-4975bf02b291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868215, "uuid": "fdc5d20f-a87f-4cc2-ac7b-49de2bd4c99e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a0b45d-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894005, "uuid": "58ab813a-326d-48e8-a608-77c643791022", "comment": "Malware payload (Mirai)", "value": "59603b0a985b9bf991540e0cb5a7d27c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894005, "uuid": "84734e3d-a12b-4784-bdd9-11ece85e1dc4", "comment": "Malware payload (Mirai)", "value": "cb66f0b9bfb996b5e4fe142cd03b3061b9843899675d93690e5474e87ef1bef2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894005, "uuid": "d7844d48-326b-499c-8bdf-fc1c550a9648", "comment": "Malware payload (Mirai)", "value": "115bbb6fb47522a370ada763227b5332b4e89a4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894005, "uuid": "8891bf6b-e30c-44c5-a9c0-f6c331f064de", "comment": "Malware payload (Mirai)", "value": "49c1945c10bb22ec00b1ae40879751c943123d93a3dd560a5abe577500f3c8883f07678cdf2a1937033c586b06c71af4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894005, "uuid": "5bba3084-6ed2-4517-b2f3-a31373a9a792", "value": "T10FD2E02CD99D7D05CA6D3EB950DF55B5394C70C0B35DEACE17268058B627A8BAC070A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894005, "uuid": "112fc232-098d-47ec-9141-8f8ae2108a6c", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNbJbiWUt:1bDs06t4BEub4sU/MbUbmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894005, "uuid": "1f4a53f1-065c-4733-b1c6-355238a0cdf2", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894005, "uuid": "1e2c80d2-160f-4e91-8254-160e0272d48a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894005, "uuid": "0995a620-16ef-42d7-812c-6703ce3c86b4", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9b9a7a-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929970, "uuid": "8fbfd898-658a-4f37-9d57-742fbb4ff140", "comment": "Malware payload (Mirai)", "value": "ddd0f2745b8224f6afa9737defe4e56b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929970, "uuid": "21382e59-9b1f-4f0c-890b-de16ba5fad00", "comment": "Malware payload (Mirai)", "value": "cb7e030890020c8d042b534ca614437a484d296dc1c36e7f354e0c3574fd92e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929970, "uuid": "24e457ad-98d3-4645-96b6-a15b0a81a52a", "comment": "Malware payload (Mirai)", "value": "f9f47a1c9b5f219b2606358a67d025c4adafedf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929970, "uuid": "0ca7a4b5-dbf0-4465-825d-a5500a6dc8f2", "comment": "Malware payload (Mirai)", "value": "9bda0fa55d708be592dea0eb7499bd94d39edef94d86d91dedafe9ece5cf1666473bb9b4f1920115dc1368a089f7f592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929970, "uuid": "ecb1467e-77f9-49ea-ad58-fc6fd18414f9", "value": "T168435B0273280A47E1565FF4393F27E083FEE99021F4F689264FDB468275E73158AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929970, "uuid": "2e0139b7-5e35-4ce8-a90a-3ff5289d49db", "value": "768:EsfizT3u6bC6mf/co0ytRn0pa3uTKpG79Lqz5q0CuoAYa/A3jv3C3tZAIs4stJJf:E0u37bkco0KZ3G96q0TdT43jSjszJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929970, "uuid": "bd61462e-7109-4044-814b-796dfae3e3ee", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929970, "uuid": "cfa49948-fb89-48e6-9a04-e2cd9f2cf2a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929970, "uuid": "fb0b7329-e5a5-4b13-8f5a-034d83cd9849", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b6d6c6-8875-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756869906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869906, "uuid": "b27adfc3-6435-4479-a583-ccad26325aa2", "comment": "Malware payload", "value": "3647250de2a4458ee5abc151c8c63540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869906, "uuid": "f9604f49-f06b-4a1e-86ea-ccd134bbaa81", "comment": "Malware payload", "value": "cb934ee97da2f073504353be51e79a680c6a49bfe26bd0852bbce28b59ff1f23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869906, "uuid": "5bdc5c70-a3ba-46dd-8740-3afed2774420", "comment": "Malware payload", "value": "4fc10c86359cef22d95c8bc3d7bc4cdb23fbac45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869906, "uuid": "60e3ecf1-2bcf-4b95-88e4-e430f11f9165", "comment": "Malware payload", "value": "2870b56c91cc73384cb99d9b03e631f29ceda99d131d5a62f638edf3c11552217eec74aed4b98d8828a833ec6dbf2422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869906, "uuid": "564a049f-d750-476f-a001-452e3062b962", "value": "T1A2B4C04A736810B8D467D238CAA38A47E6F27856077497CF13B087B95F277E1663E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869906, "uuid": "c13b2092-5569-43e9-9003-00ce6e1891c1", "value": "21b10bcbac6fcce20fa8ed75e32bed96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869906, "uuid": "50d79bb8-d33f-4328-a95f-463ed379bbec", "value": "12288:Aou46NdX1lMefoyb+AHCN+LsKT+sXEUf0:9u46Ntdf/d4KT1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756869906, "uuid": "e518ef52-f6ef-429c-a2d4-22ef044877e0", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756869906, "uuid": "318d063f-d720-4db0-9613-bb4fc5c24693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869906, "uuid": "f8607234-8cb4-4efd-ad4e-43d71040dcdb", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85091ac-888b-11f0-91c6-42010a9c0006", "comment": "Malware payload (XenoRAT)", "timestamp": 1756879519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879519, "uuid": "f71c30bf-03bf-46d8-b366-979b037a8d3e", "comment": "Malware payload (XenoRAT)", "value": "e0884dfb1745aaad8ef5adc08f93ded4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879519, "uuid": "1ff1b4c6-2cd3-4a6d-b970-ee0720c63531", "comment": "Malware payload (XenoRAT)", "value": "cc14bc97e9926353ea4953e44a12e673654b98bdcbc7820ae9ed48868c1f5af5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879519, "uuid": "a67bb889-1320-41ac-ba24-3aa92636d248", "comment": "Malware payload (XenoRAT)", "value": "36bcdc0d4a2756a8fd542e7d283498e45bfb8f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879519, "uuid": "38301785-0bee-4874-82f8-2368f8f723a1", "comment": "Malware payload (XenoRAT)", "value": "3a7fa27cf19baaad6ef9a72cb3fc18fe0da569be9d15103e2b6c44ffac1f7eb1ab096eda4bac50c97f99bedef8a1beb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879519, "uuid": "01ef96e8-4f00-440c-b49a-2d6c212b3bb4", "value": "T1CF23F84C57AC8923E6AF5ABD9832425387B3F3669532E38F08CCD4E9379338555053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879519, "uuid": "54aec3ae-b467-4527-a6d3-2156d53d4ab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879519, "uuid": "68e5c738-2f66-4b38-89c1-74fe4821032d", "value": "768:tdhO/poiiUcjlJIn57ElmH9Xqk5nWEZ5SbTDaiuI7CPW5F:jw+jjgnFElmH9XqcnW85SbTXuIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756879519, "uuid": "e085ec1b-a5be-469f-a2e7-1c63d019e2a9", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756879519, "uuid": "c7578c60-57b1-489a-9283-4f3412ba095b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879519, "uuid": "c2c42be8-f397-42c5-b627-ff2a4db18915", "value": "e0884dfb1745aaad8ef5adc08f93ded4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9937bdc4-8873-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756869052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869052, "uuid": "668daa15-5e13-40c9-bfc8-8ba34f0a0fb9", "comment": "Malware payload (Mirai)", "value": "0f5f1c6f264fa6ba3e2923334b013396", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869052, "uuid": "397184f9-b7e4-46fc-9252-3315d7b66d2f", "comment": "Malware payload (Mirai)", "value": "cc17e2cdcd42f52b36ce6d413958c8e611e8f769f0406d3d433d7a7e14529c63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869052, "uuid": "bf64f12b-4eed-4aea-b3ea-d555e2888a9d", "comment": "Malware payload (Mirai)", "value": "b7a175d047c2a66d8379da1763940d180e07889d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869052, "uuid": "aec663e1-3da5-483e-9a7e-7fa7c9ee068e", "comment": "Malware payload (Mirai)", "value": "8fd1dcf5d4ce4ae26922cf0b7bd74d332dbae8836154b5b8fad9adcde697c475e13a77d5f2c6b9635a9a320c5e907cb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869052, "uuid": "5ad993a9-6a01-467a-a43d-0aff5811925c", "value": "T12B731B95F890CA32C6D156B6FB5E428C73130778D3D93202DD249F3967EBA5A4F36902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869052, "uuid": "d177a775-1cce-48c9-a2a9-1ed9aa74edde", "value": "1536:YjOVA4jwL6UwBA7FN4ASpxQnY99F/3OM2M4+9LxeEsN4q6HNgpsTOW9nGIr:Yj+A4jwL6UwBA7sASHQiUM2M4wbsMXdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756869052, "uuid": "06b39b51-70f1-4cc3-8267-97428eb00783", "value": 75020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756869052, "uuid": "4541c270-2dc7-4e9d-bdeb-5018a34e3279", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869052, "uuid": "b656044b-0186-4743-9735-c354655945ab", "value": "kitty.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fab736-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872885, "uuid": "5dc1f053-dd11-4d71-9dd9-b8eaca9da6a8", "comment": "Malware payload (Mirai)", "value": "7e641cdc795e33f4757b34a401551b82", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872885, "uuid": "020f95df-3694-4af5-bcfe-2a38a9415835", "comment": "Malware payload (Mirai)", "value": "cc467f82513793e223520f6360178ee6d05f439442ea54652b7cb1d714b04410", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872885, "uuid": "bc7ec132-c76d-4ab9-9c74-786cbfd612c9", "comment": "Malware payload (Mirai)", "value": "75d6335dbff9960c80d10a53c4475e1612753851", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872885, "uuid": "aa375e1b-78b4-453e-bfb9-939491963602", "comment": "Malware payload (Mirai)", "value": "8ef96bded78ddde0c2645aaa2ed44508992be52dac70fe05c9e89d525c8c03342710854e5332d9ed66d9e8d9592fb21e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872885, "uuid": "0f9c9c7c-64ff-445e-9de5-e0afe50033c2", "value": "T13B31908852610972BEAAD8C7376B4E8E300A74EF58C6DF71A09CB9F3609CDC07442343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872885, "uuid": "ba10a28e-fce4-44eb-b14c-f79af08d3000", "value": "24:sW6ZpnbE2LiCXyMHBF0RoEoL/bREZYWkTnRa2UdV:hCg+iayM7qPoz1okTgzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872885, "uuid": "521a3333-ebf8-4891-ba45-1ea1b9aa7802", "value": 1707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872885, "uuid": "e6593631-6feb-4299-bf1c-ce5305a1d060", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872885, "uuid": "ce169475-f759-47c4-8672-bbb0cd6ad343", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bbfc2e-8909-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756933548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933548, "uuid": "cbd2910f-e76d-426b-ade3-ca200dbde64f", "comment": "Malware payload (Mirai)", "value": "a8f7ab7fb0fc33ec528e852f4fe23458", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933548, "uuid": "c6fc4587-5cff-4e71-9b8f-c04de264b734", "comment": "Malware payload (Mirai)", "value": "cc9e38778b68071bce9b1308bff956bb65e109cfbe1bd5c27c904f8e1429d1d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933548, "uuid": "1f927217-6bc8-4478-aa5b-76f21309348b", "comment": "Malware payload (Mirai)", "value": "2108c53239bc38bf25ca35d58f6ac12a82d52f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933548, "uuid": "e2cc5bfa-14d8-493e-9fdd-e589205ee295", "comment": "Malware payload (Mirai)", "value": "d97fdc5dee3204962a19377166b0106defb4892d17fa6b0695457f64d45a4bd95490afc8979eac5f21ac7fbb2aac7322", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933548, "uuid": "f69f81bb-df69-49dd-af59-caf696af43fe", "value": "T13A041941FC414A27C6D711BAFA5E528D3B2617E8D3EA7203DD255F2037CA89B0D3BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933548, "uuid": "83c00d16-2caa-4890-b951-32d19512e485", "value": "3072:abdzh47oVTaS5GaeDoN4o6RvqpIUKsnnF6hh1RU:EdF47yTsTUN47Rvq2FcmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756933548, "uuid": "69702da3-9d9f-4f5a-99f2-b71fd295e102", "value": 178368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756933548, "uuid": "a4e5bd5c-e97a-48a6-84f7-7e554ada78c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933548, "uuid": "b0f552d8-112c-46d7-9448-53cd05d8ce34", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181ef597-88a2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756889021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889021, "uuid": "7869a45c-42f0-4792-9866-b5b04b485077", "comment": "Malware payload", "value": "d4501d38ca970e267e4e3bfb43c371bd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RBL", "colour": "#A55C08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889021, "uuid": "928ca522-2f93-45c8-a405-a738544bffad", "comment": "Malware payload", "value": "cd301491d5bb40f126d72ab157881de92b7790cdf01f65d2927e39623ad5ad46", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RBL", "colour": "#A55C08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889021, "uuid": "53ba4ef3-420c-498f-958d-abea44678c6f", "comment": "Malware payload", "value": "01f1576f1a9662d384fc44ddc6ea6980dbfc6324", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RBL", "colour": "#A55C08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889021, "uuid": "87663cf9-180c-4633-9121-47b9c8edd9ee", "comment": "Malware payload", "value": "eb29f87d92684228ec91169542484995fee9874f729ea82fe8e5de8d46fc2db1a3b24eb8101d8f477d379f319537d3e0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RBL", "colour": "#A55C08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889021, "uuid": "01649911-c6ec-4d1c-983f-6413248fb0f3", "value": "T146A63303FAA4A82ED8B5D97369402BB510192E05C785328F399937FD78F7ADC4B813D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889021, "uuid": "f5d10ecb-ba28-4c2f-9bd8-b1146273bebf", "value": "196608:51RXmJi+069UxtRviTLsiX4Mfvw5DhUvGrXQjWFvAUW3wz:57XhbxsLlX4M30aGO3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756889021, "uuid": "65c9342c-d9e5-4a07-9933-86f3dfe29eba", "value": 10364736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756889021, "uuid": "8f954df2-36ad-484d-bd17-4bc12bd0138a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889021, "uuid": "f47bf39d-9cf5-4c8f-8f09-c893f87c72e9", "value": "RBL Credit Card_1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0008b95a-8873-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1756868795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868795, "uuid": "e5493f58-0707-46cd-827e-71087372e899", "comment": "Malware payload (Joker)", "value": "efb415640fc64837adef226c61070dc8", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868795, "uuid": "026f26bd-e896-474d-9070-5507b8301f35", "comment": "Malware payload (Joker)", "value": "cd7a9667d46564b116a25a1ab12e692f93071b185e10286a6e5dedb0f802534f", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868795, "uuid": "e85d89df-b659-47bd-8f65-9a343d76c67a", "comment": "Malware payload (Joker)", "value": "129b56fb43a63bb51db02af40e58245fd06645e3", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868795, "uuid": "5a8a8a1b-f122-4efe-a539-76c60e8a6173", "comment": "Malware payload (Joker)", "value": "ae4753acc78306fcd3308968bef71f17c0b16308ae35ad590a58858f779cd920aa231a57d7fbebd5b7b604965b7fa0dc", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868795, "uuid": "adadd28b-0350-446e-858d-54e2921213be", "value": "T198572217F70CD92BC9E7B43899AB036262256C8C564087575A12F22CBFF36D4DE1ABC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868795, "uuid": "303886e2-c4ab-432f-90e2-a30a65e223b8", "value": "786432:SL5K7NQMd46gVhoDmTnJCvJhxLIybru8BnyFc+xc:isNRmKmTIJXLIybaMyFc+xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868795, "uuid": "a1701d0e-6d77-44f4-8023-e956e86a6acb", "value": 27428213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868795, "uuid": "5323c772-74cb-42e0-8910-03328abcbd11", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868795, "uuid": "61fb2029-e6dc-4843-ad65-c98bc54b9382", "value": "Deep+Cleaner+Pro_1.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5775e2d9-88b1-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756895570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895570, "uuid": "135c6b97-a385-44a2-aea9-d7418190a81d", "comment": "Malware payload (GuLoader)", "value": "b85b09a61390b3c5a1c70ee916fb80a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895570, "uuid": "0aab8691-32cc-434d-8087-af2b6d7ebba9", "comment": "Malware payload (GuLoader)", "value": "cdd2c8120d61247bbb83f791071f2d99227cb3f0e5129096441ebef1ab014965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895570, "uuid": "05702812-b2df-4dcb-adfe-d41fa5f09635", "comment": "Malware payload (GuLoader)", "value": "004e30a4a2ebe306cd71dfe28dd011289cb5a348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756895570, "uuid": "97d73a4c-f164-4bc4-8420-06606c74f3f2", "comment": "Malware payload (GuLoader)", "value": "620d4a5a8f06004c956dee7c3f26fb7672d947d6eac25b437fb7a8ddf7fc6cadd725092a5976dfa4d9497be99945b423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "starmanx-org", "colour": "#FB9A3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895570, "uuid": "91205b5f-06d4-4553-ab36-a80ed2e46d88", "value": "T15BE5337971838FEBCE85FB707DB3D8A346A41C149D4D7B777A803E8B243611A6D0A264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895570, "uuid": "7006cdc2-e52f-49ea-90fb-b829923c593f", "value": "84062c623770f0d888e4ca58451aa7ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895570, "uuid": "57290ba9-cee0-4e3f-80d5-34513434e225", "value": "98304:bQc82PKZlI758JxP6bfNVxGLrBAwZhTwGL2bAAU0:bQc86t6EbqrVZh8G/AU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756895570, "uuid": "ad1e8899-f012-4f0d-9e36-50817c24e0ba", "value": 3276309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756895570, "uuid": "a320a7e2-162d-44e1-936a-fc6dc209d64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756895570, "uuid": "695d5049-4401-4659-933d-b3aed3866817", "value": "cdd2c8120d61247bbb83f791071f2d99227cb3f0e5129096441ebef1ab014965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff62b45-88bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1756901463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901463, "uuid": "0125f292-8279-471c-8b42-e530b3ebc61c", "comment": "Malware payload (VIPKeylogger)", "value": "9756664c0053426fe68db7b618b348a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901463, "uuid": "988cf0ea-8a85-48da-b156-3df84fccb542", "comment": "Malware payload (VIPKeylogger)", "value": "cdd3e1df943980f48c8ecc7446093e1ef3560dc0530495923da9c3521e7e6463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901463, "uuid": "ae54694f-a10f-423a-8c57-6833bac089aa", "comment": "Malware payload (VIPKeylogger)", "value": "15887f8a58d88cb22ea4d84fb09271e7b64631ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901463, "uuid": "2a08d296-b2d6-45a7-ae71-015256a80dfa", "comment": "Malware payload (VIPKeylogger)", "value": "83629eff7520b8c270f2ee15f30f1a2a441da92dcc06083a76e76e53ef7058d503a7c79ef1926ff164b0ed918dd38215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901463, "uuid": "e2f94251-e7d2-4513-a3b2-a41a67de4d14", "value": "T1A65523137A08A772EF7706306C1E4F181B927CBFA590629F1388F36979F15728A9F254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901463, "uuid": "f03f0a6f-cb40-466b-9544-580dee8dbf07", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901463, "uuid": "854abd30-7dec-48ff-9be9-2caa56b1a6b1", "value": "24576:w6GRbNQvWDTratvzxWsMuaTdnv6AULOC66v00sqI9RpE56VWOCDK5Wn:qbvTeJzosMRxpP6psVbW54CWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901463, "uuid": "92616e9f-400e-42b5-a34c-3d73ae90a5cb", "value": 1299920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901463, "uuid": "6163e7b4-b325-44a6-bb15-5f7d06a96716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901463, "uuid": "a827fbda-cb21-43d5-add5-784b1496c60c", "value": "hale Bilgisi Dok\u00c3\u00bcmanlar No 2025-GE-218567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a42e39-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929960, "uuid": "96722e79-1054-401d-8795-563c6c0f99e6", "comment": "Malware payload (Mirai)", "value": "3fab51ed728c85c2d93c9c6166bc0187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929960, "uuid": "ff427502-b418-49d3-97c0-c3a83fa2c789", "comment": "Malware payload (Mirai)", "value": "cdf03a3e6099b811193de8bfc0b098aa352235ebd2dbada2f6a977fb498d3f44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929960, "uuid": "2031b4bb-3982-40d1-ba7d-8927e37cf7a7", "comment": "Malware payload (Mirai)", "value": "73659fe7215715436b859f0aa93d0625e54c4250", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929960, "uuid": "3ff68c3c-ae1d-4a86-86dd-8084b9957088", "comment": "Malware payload (Mirai)", "value": "9dbf05fbcdf9efba4d689983125bd73d67ad8bdf9a02c48065ed984ba8fd75989a7afac9d21bc81ca3a9a1e9db0773d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929960, "uuid": "90b05546-7e58-4c6c-a189-c9b7a3bbf342", "value": "T15F3318D6B401AE7CF95BEFBE8012490AFA31621251930B3B637BFD936C322658D53D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929960, "uuid": "687e8d6a-f402-4d33-899b-2de068d97190", "value": "1536:0utWMN1XNHDloxKuNoST3GCHLnWqfCVM5v9b86:00zluKA3GAL0M5Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929960, "uuid": "a9406e84-9a97-4c77-b8cd-c060085c5c26", "value": 52516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929960, "uuid": "ee128575-5f7e-4eca-9084-9b82d9822cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929960, "uuid": "e4ca6743-367d-4a4b-8783-63d0bcb90973", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1201300a-8875-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756869684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869684, "uuid": "fc45a233-15c6-455c-ab29-31054a593b26", "comment": "Malware payload", "value": "fa24810b0fcd00163be5d72a81ba9bfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869684, "uuid": "91878cd5-22ce-4e9c-aa10-bcef9d880672", "comment": "Malware payload", "value": "cec784f737ba04e2918af17a40375077a72b8eb2122beeffd91efb88b2bd9e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869684, "uuid": "446feb3b-e287-48eb-bcb1-cbc02dddb21d", "comment": "Malware payload", "value": "5559348c42b97856ebbb66e3cb9b0b9af5d855c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756869684, "uuid": "6f452e4d-7cc3-48c6-a9d6-46e18110cd56", "comment": "Malware payload", "value": "4896fd2ffdf45db261154497586faffda2a017afa3b97268484daf9c3036954126b1e49ba7637d476ff3ce79c1c9205d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869684, "uuid": "745d4478-9b16-4ee6-aac6-b9c86ab4615e", "value": "T135C533B1F6301767E1E9D37AEA1126CBF662412510ED08B69FDFE2D1817CBF619AD002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869684, "uuid": "e0971321-a2e5-4f73-841e-95143a03f73e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869684, "uuid": "8c2ffb4c-6c0b-4a3e-a347-75e95859b667", "value": "49152:iDXd6eY2ZJ9ylUAtVzn9v5mBewD51sq/2MahuNs5iqSS:iDt6b2ZJ94bj9Bur//2bS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756869684, "uuid": "0fbd6249-e2cb-4896-a5bc-b336e4981ac8", "value": 2594816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756869684, "uuid": "d3edc3f7-819d-4161-b5fb-e62ab7e677b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756869684, "uuid": "d7534ec5-b42b-4cd3-a8af-7405621006dc", "value": "SecuriteInfo.com.FileRepMalware.96588757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ec87ec-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866769, "uuid": "fd7704dc-9683-4347-a902-31bdc15aab93", "comment": "Malware payload (Mirai)", "value": "7dcf3051c01623ca2b47e35bb9567ca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866769, "uuid": "687a12d8-a3f4-4bef-bc0b-3dbf43c0db1a", "comment": "Malware payload (Mirai)", "value": "cee18d2b80d8e3950cadc8c05bd9f3fe24d5e383e0d07a0af29c58887cf262a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866769, "uuid": "a058f303-4fb9-4fc6-b092-fb7673ab3e7f", "comment": "Malware payload (Mirai)", "value": "a0c0c2ce229a9765b4ab8194b0732f3a62afb021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866769, "uuid": "f45aca6d-c2d0-41de-93ad-6b1e18794f91", "comment": "Malware payload (Mirai)", "value": "22b7d5d3b8deadf99656e6fc002476c2dda10fff5b7547c3356980df82933f554010c43936f76dc4fb9e71000cbb5560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866769, "uuid": "cd57947d-4dc2-4dfe-947b-9f251aa09de6", "value": "T1F0B2C0CC61943084C58D7C7C578D4E664FACA190FAED9F26E360CD9873AEA4B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866769, "uuid": "b07ee011-0d0c-474f-9a67-ad8aa48050b7", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpFZqSWvS:4QlS07FUXqIYSXQKqu7qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866769, "uuid": "055027e6-e0b7-44d0-8c74-d74b40fff897", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866769, "uuid": "6b1cc2f5-04d4-493d-8da3-3f4e168a4c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866769, "uuid": "695803be-e706-45a4-9ee4-58a65e8fb387", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10f80be-8903-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1756931047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756931047, "uuid": "03c49a75-e3c2-434c-a428-3541cfca643d", "comment": "Malware payload (QuasarRAT)", "value": "383ab79245464e584382800bde32fba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756931047, "uuid": "2ee05cc8-de1c-4a96-9db9-c2d60c74c462", "comment": "Malware payload (QuasarRAT)", "value": "d017447f8ef2d707ce3a908e05bcac2206d8f5b8d63b72e494a81eb379b69853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756931047, "uuid": "ed82ce63-8842-461c-84fe-b9105db40d87", "comment": "Malware payload (QuasarRAT)", "value": "8e3ea9f56f2b0642c251fcdf3bd9b11d526a9bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756931047, "uuid": "32be7387-6d2f-49c1-b07d-815a9b8d8876", "comment": "Malware payload (QuasarRAT)", "value": "e225a51174135c322da73addab0377f5fae8998d2df5f31d0a8469f48d02ff3ea051ee027a64764cec6b28e6753b0b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756931047, "uuid": "a8f4d73d-9c34-4b10-bc5b-43b48ca7d888", "value": "T13E950121B7F5810AF2BF1FB9A5B344550B37BA139B3AD34E558CA06D0EA37418E513A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756931047, "uuid": "b3dfcaec-2118-408a-ad3f-01bdbbdb36d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756931047, "uuid": "627ca1a6-543f-46f9-83fc-9a66b38913d2", "value": "24576:NETCNS2eWBRwRR16z/0m8yXP8oc5R2NntxY0KKm77yviUSQaZaOwI55l2S62r9iV:NWCr7wRPirm2NnPTKKm77LrwCB6uanx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756931047, "uuid": "e7b1893b-eedf-4ed0-b99d-1da13cefd996", "value": 1949184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756931047, "uuid": "ba4f7914-5b5f-4d85-9df7-e3e4ddbfe9e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756931047, "uuid": "b3aabdc2-444a-4c0c-b233-a8e5e5f690e5", "value": "rc7 info (credits to darius).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d905ea72-88a3-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1756889775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889775, "uuid": "59a5d5e2-60a8-46e0-a436-b7310a19ddef", "comment": "Malware payload (a310Logger)", "value": "c8afd5835515b2ed6904632eb8292d1c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889775, "uuid": "b3954f20-bb9f-4a7b-a3e7-94eef775d9ca", "comment": "Malware payload (a310Logger)", "value": "d05889fa2aef7ae780aa7aa6ccb000b684029b9bd2815cddb74bbdb9715f0471", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889775, "uuid": "8bf414ff-ef17-4be3-9d85-671490a4d493", "comment": "Malware payload (a310Logger)", "value": "c262e26e55afd7ec32fdb09445daea0907f070bb", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756889775, "uuid": "6cb32576-d2fc-4558-9008-2495ac8903ba", "comment": "Malware payload (a310Logger)", "value": "bda8d1450b6bba3a9aacd230841d1a3a07ce203d161f776781d1a9fc58a8c63c71804603e60501759781fb13ce904c9a", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889775, "uuid": "0bf26d17-1f9f-4cc4-8cff-284af3946c9f", "value": "T175053393B4FEACA6578D38F031E1FC66FB95D98A7282576CC80416E2E6067D3E411933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889775, "uuid": "030de447-529b-4195-aac7-8d1c9d8d88de", "value": "24576:MUQglt8h/F7qWPF4miAL07HbnqUCp8eLo3MujkBwkB:LnkP7qWPKLAAjbqUCpRXfBdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756889775, "uuid": "d90d5fb0-9003-4a2e-8c05-bf6885e25517", "value": 833780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756889775, "uuid": "6f324305-ded4-4957-8b8a-bd74e014f985", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756889775, "uuid": "cc5b831c-febb-4039-97c1-1217f048fc1a", "value": "PO20325-23 J-100.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a92546-887f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1756874139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756874139, "uuid": "c4f9b342-2a71-4dc4-b2d3-4760c49faa12", "comment": "Malware payload (Stealc)", "value": "54b9c02ffdbf6e365f89c5361925e2e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756874139, "uuid": "dcbd6ca9-5ff0-4050-b391-011eb03a3fce", "comment": "Malware payload (Stealc)", "value": "d05d6df07fb2fb70e80fb69bc8e38600b88711b2d179e024e4cb96aa43f272e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756874139, "uuid": "0817d834-2a23-4994-b3fc-7c1dee26d327", "comment": "Malware payload (Stealc)", "value": "c3a29bd550c4e994ea4ae90e2abb8fe20f0a5848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756874139, "uuid": "2880a881-48c4-4cc4-aa36-d689545ef7a0", "comment": "Malware payload (Stealc)", "value": "1cc6aafe8f3c44b2bd0703d555ba433e3ccbe4a2e517875a9db042b401b754c6f187a892556d2c796dee3029391013ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756874139, "uuid": "0d7b6a64-f5cd-4518-9b28-e2270aa3f39e", "value": "T1E775F118AC7590DAFCD340706F7A9112E533BD7BCB242EAB41E497511A06EFD0A3E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756874139, "uuid": "92af2880-9126-480f-8900-775a0345eb38", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756874139, "uuid": "bee0d17e-c85d-4fdf-b17d-858e9e151eb6", "value": "24576:tUYxEL+Rbj/0c9qx6rFdmJYPC0pAWs6rnYKT4H5rzm7vI8sMjpU7Y:tUAE69t9qsFQ0pI6r2Hx8s8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756874139, "uuid": "c3c7fa18-670d-4796-81b7-ee7a54bf0f7c", "value": 1659904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756874139, "uuid": "59c7e392-be42-4659-90a1-8798cfba32fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756874139, "uuid": "e4e224b8-c82f-416a-9e4f-7c0c8ddefd38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d83314-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866840, "uuid": "dcdd65b2-dd2f-4d9c-9414-e58d66075d49", "comment": "Malware payload (Mirai)", "value": "913200a11df9316eb2f91673c7f83951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866840, "uuid": "04af1d36-320d-47a9-bd44-67e85a313fef", "comment": "Malware payload (Mirai)", "value": "d12d182a7d20826cc9d2dc8b5afbc595dd9951080f1bf5f5f0bd17acdb84aabc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866840, "uuid": "24c75a5e-bced-4956-9551-214e3ccd8b1d", "comment": "Malware payload (Mirai)", "value": "391f54991dcf361d4800a1938689f9c6dcf2e484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866840, "uuid": "a66edbb1-bdc1-48dc-84e1-329ad87c6be2", "comment": "Malware payload (Mirai)", "value": "1ba00c845daab96dcffa8d7839980294ec9ff1bd81804864a2ddfd9a08b82f690c442e0c65f37e12f426814558225c74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866840, "uuid": "1f87ae45-093c-4021-8896-39e22dbea1f9", "value": "T12F431891BC819A23C5D4137AF56E56CD372133E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866840, "uuid": "8e553256-b65e-4e3d-9cd2-19715499f2dd", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866840, "uuid": "76a2593f-982b-4b1a-ad5f-622acd167b66", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866840, "uuid": "60cdd1d3-d90c-4992-b8df-d3d69b9dbaa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866840, "uuid": "c7ac0f28-437d-4bf6-8a74-0237221642a0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877d5548-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872887, "uuid": "2330266d-7f3b-4c38-b118-f44fc0e03766", "comment": "Malware payload (Mirai)", "value": "8b5ae0e65730efbec5305c4e58a01be6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872887, "uuid": "74654030-4b23-4db0-92da-096c9e6ed793", "comment": "Malware payload (Mirai)", "value": "d3316ac59e69d8c77f4fd96521f9d76242ca8cdffc219891fddcb721319aad78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872887, "uuid": "079577e6-1f08-4be8-9030-69278bc379d9", "comment": "Malware payload (Mirai)", "value": "4281a873baaa2f2053fcf37912a893949546d99e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872887, "uuid": "17ae971f-f9eb-49f4-bf5e-19f7ac8cda39", "comment": "Malware payload (Mirai)", "value": "12e5d685331c0756c1e1517d8bf8cb1779ef4a92f11eb45b1a5b100d9c5877306cade1d79af05379efe235d059d8c7d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872887, "uuid": "9848c1f3-2b39-47da-b8e3-c7906390dfa2", "value": "T1A231D4C950A086B63CD49D8B756BCC0E3027F58E18C95F8ADEDC34FA588CE81B055703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872887, "uuid": "7a54d5cc-08bc-44e4-81e8-d582f9ef2e75", "value": "24:sF+l/2rvvT/2elc/2+sAd/25ctl/2n7t/225s/2CsX/2Di7/2QR/2z2O/2o:eiK7QDNNKJtQ+SGTUZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872887, "uuid": "015b5372-e816-4cc4-ac0b-b355de46eda3", "value": 1549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872887, "uuid": "be1bfaf5-4685-446e-96e9-18f3e80b28d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872887, "uuid": "70f0ddbe-e98f-4f14-baa0-b03545382b2d", "value": "linnn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed602b6-88d7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756912011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756912011, "uuid": "efad3005-846a-49d2-943b-322139bf860b", "comment": "Malware payload", "value": "87a97f47812b7a9f3d47943bf168a85c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756912011, "uuid": "d51d1e27-d38c-4145-8d39-1625f44ec375", "comment": "Malware payload", "value": "d37ef6e8bf5634c480b229937c7c41f3e1ee39d4ad8a676795eeb39b951d1da3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756912011, "uuid": "3d17a5af-8679-4319-af5e-8919f2e4f779", "comment": "Malware payload", "value": "00703cc52b3f955c08dba80d2b3bc6ba4131fe15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756912011, "uuid": "002c35e1-28a7-464b-afec-76cab0e6f8b0", "comment": "Malware payload", "value": "ffbd787e94c80dfb01343cc7e4871dde9567db7c2b4b00fd4ab3ab85d1137ec6b1b04c627698e6cc343a34d60c66ce83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756912011, "uuid": "610ec41e-d355-4f48-9eb4-560b6a4e732a", "value": "T10834F9076B659DF7C89FDE3306F6861120CEF8532168772A3238DB5C7A0A54B5AD3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756912011, "uuid": "68b10ca0-4bc8-4a72-bd50-12dcd3abfcc7", "value": "3072:uM93c1mcvTb1oPHWK4AhxR2j51obm3cG4GxWcwc6M1:loTbS2AhxR2j5Obm3cG4GxWcwc6M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756912011, "uuid": "5eef6632-117d-4942-96b9-c074c1f3c56b", "value": 230479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756912011, "uuid": "1f3f8f53-4d44-4b1a-8808-d64bc62b071a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756912011, "uuid": "d9e3de59-562a-4c1d-af37-3412dfc26692", "value": "test.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef731f8-8893-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1756882778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882778, "uuid": "079a9a79-be4e-4fcb-957f-71f484de34bc", "comment": "Malware payload (SnakeKeylogger)", "value": "ae39571a1e605dc098e4fe3f04c6cf2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882778, "uuid": "f1f5f7cd-76b9-4540-acd3-4ad22b371646", "comment": "Malware payload (SnakeKeylogger)", "value": "d41022d91ed5c237cbcb1cfaef080005bf5dae114f06418c873596c6c0149a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882778, "uuid": "1eab3f5a-5562-4b38-8811-912d3329cc36", "comment": "Malware payload (SnakeKeylogger)", "value": "e6c7884b516f29753aa890dc95cfb9488c74a58a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882778, "uuid": "7e9da4e7-4a04-4fe1-afca-ff5f61f64433", "comment": "Malware payload (SnakeKeylogger)", "value": "7358cff5b41540fce61fa1ee26c9d31395cf4bc25cea65258b86567b0189b66b5185184028940807638b1f302123775c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882778, "uuid": "f0c57ae5-5b1b-4693-a1ec-e9a048c29c73", "value": "T1CFE412982766CA02E9F61BF18C60D375672E7EAD7522D3138FECADD73536B401A90342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882778, "uuid": "18459a56-38a8-457d-bb57-8a108e9dad53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882778, "uuid": "2390607b-36bf-43fe-a74d-dca81ef90ed2", "value": "12288:KJccRPFqfB2Fz6cVX3A9bW8zoqwzjFv3j1Ylnpbvbr+RfJ0OWF:KnPqBUXaZoqwzlT1MntTray", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756882778, "uuid": "862891e3-f230-4408-aba1-4065a2deb1d9", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756882778, "uuid": "7d48b2b6-2fd6-466a-b91d-0b97afd33fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882778, "uuid": "2c24b3b4-1fc0-4e98-9fd4-d5d5e07e673a", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c1b35c-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866764, "uuid": "085436a2-61c4-4cdd-8a7c-4b357f9f2095", "comment": "Malware payload (Mirai)", "value": "0b1bd2860f51dea622f260e9a51acabc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866764, "uuid": "5c562b43-afca-4671-81e2-b55fc4ae0a4e", "comment": "Malware payload (Mirai)", "value": "d471511610fafd898ab3f4bd694b0bc3141e22276d1379fa729ab468e3c0179b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866764, "uuid": "413ca5b3-9243-493e-ba33-d3b207b259f1", "comment": "Malware payload (Mirai)", "value": "05c36085d5468099b30852c9b4d999167f5caecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866764, "uuid": "7f5577c2-7995-42c8-9792-feeccc7e10c9", "comment": "Malware payload (Mirai)", "value": "8c0b67351eae5ddd32bd2bfbc7943d4015cea33dde5a79411d58a447ea6fee9c2babc07bff6ac30f3bc51faff8c25ec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866764, "uuid": "d9218a1f-57b9-4404-b366-f89fe7f21398", "value": "T1CB330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866764, "uuid": "2a7dcf5c-fb90-49c3-a704-f7c8fc772ef8", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oGF:r/hqaJM53eqK806MHdMfQXoHuCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866764, "uuid": "81bc30a3-8034-4949-9591-5a867c588b4d", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866764, "uuid": "376eba1a-6a61-427e-872b-7830b9024370", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866764, "uuid": "ae0e23fd-30da-4764-b878-5d757a3cb5d0", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fc455a-88a4-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756890113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890113, "uuid": "59661e4c-4a00-43b9-8037-032d7a9627d4", "comment": "Malware payload (RemcosRAT)", "value": "97fa279c4140ef8c974b7b7cdfbdbfaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890113, "uuid": "7b496313-a83b-4b37-84b0-5f7314c0d4ec", "comment": "Malware payload (RemcosRAT)", "value": "d52658fad02bdbdd90eed0d9029e15b6359efe630f786e3ab5875e2a7f3d5056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890113, "uuid": "c42651d8-d29a-4be6-a06a-f14bfaf1b4bd", "comment": "Malware payload (RemcosRAT)", "value": "d19f651159dd17454f533a0ac86ccdb68e2fd9fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890113, "uuid": "aeccd89f-db7e-4984-99e2-424d81c3950c", "comment": "Malware payload (RemcosRAT)", "value": "df2554a521d0070fe1f2838ae03e743c9e9f0de2d8575cd246ed835b3d1baa2dd55911e1e4f3fb747460961f1cb1e16b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890113, "uuid": "6d991143-759c-4d99-b470-5fa50ae1aea4", "value": "T1601512581267D803E5A1ABF45CB1E374575E2EAEA021D30B5EE9ECDF39223083AD5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890113, "uuid": "393f679e-87c9-412e-914d-c4290358d1a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890113, "uuid": "518d83ef-1098-47f0-8ed1-07db3926b9f3", "value": "24576:/IGa2DjbcZAZtVoWxuI+gVqf/ISgrubkvcuyjT3maC31:/lRIZARsI+IeAS40uy3mv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756890113, "uuid": "7a342519-0e0b-4b35-953a-de6dec040535", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756890113, "uuid": "33ea9bec-6ddf-47cd-8660-f720276120e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890113, "uuid": "c71b94b2-a224-4905-b6c1-02279a95d003", "value": "SMK041B7H4CSI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94fee0f-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913317, "uuid": "403247dd-cab9-4b4d-a48e-1d2b947905b6", "comment": "Malware payload (Mirai)", "value": "4678fe3984d1195542ced22380499f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913317, "uuid": "251fe742-ca87-4168-a570-a8d7bf88b509", "comment": "Malware payload (Mirai)", "value": "d6e9d421b65a703f8f1898124dfd7503cfb76b9ff505e78355a7dea90218ea1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913317, "uuid": "70c6a23a-dacb-429a-b53b-26d6005e17ac", "comment": "Malware payload (Mirai)", "value": "923fcaec1a05ac67d986a12620ac8a63254f61e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913317, "uuid": "3cf21b22-731e-4845-9aaa-92836f3d2348", "comment": "Malware payload (Mirai)", "value": "64ff83e7f61c5c8fe397b083242d6108f5eb13d344e98663b708d75033220aeb2bd19618824904857f1b42ece536f9e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913317, "uuid": "b6c201ae-95f8-4bdc-9f1a-5e99cbfa73b8", "value": "T17BC35B42EA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913317, "uuid": "b5ad4cb2-5163-4e05-b6d5-c85193add98d", "value": "3072:r8wxuQyBKaeWyRSxscBqPmGIvdWD0nrScVM/9Q4vSik:r8wxuQyBKaezSxscBqOGIvgYnrSmM/9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913317, "uuid": "e0da6127-2c3d-4c24-a3e3-dfa1191e9a51", "value": 129932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913317, "uuid": "e11558f3-4a56-4591-af72-a66e37ae8f1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913317, "uuid": "2a9f9566-b341-441c-a967-2528a6d2cff4", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e54471-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756893734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893734, "uuid": "3cbde667-f0aa-4732-8952-de9b4549ca19", "comment": "Malware payload", "value": "f7b8def1cbbb183b850bc128020250cb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893734, "uuid": "e4032bbf-e09b-474c-8194-11f6a70fd714", "comment": "Malware payload", "value": "d8181472b760d0c527839047006e8449b4b79f903ab43930b7d79b7fab08d255", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893734, "uuid": "6c630ffc-2896-4107-a376-798ac7ad8473", "comment": "Malware payload", "value": "43fa65568de25a091bd2b37aef28ba793f0306a0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893734, "uuid": "95932ca7-a6b1-4444-a1be-492aa45e1ba7", "comment": "Malware payload", "value": "f5059db828bef809061bb0cbfca4f0d3dc19209c71fbc33fbdfcdb43ca4f3b8339aa0db8150ffcc88bf1c669f13d427b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893734, "uuid": "c952b553-2491-46c3-ac97-9290164b66b9", "value": "T14BC633B3E60C0D90D6EF37B9285609A92969D3C62F7381C371E597DCC9FEAA13291704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893734, "uuid": "eeb02e51-81ec-4cef-a272-7e088ce36de4", "value": "196608:5CJsaQCTaX/vpA8d0DccvAxFy1cFEO9QZiuFY2VLSbcjl/LTLHtflKaLv:M6aQCSpA8d0wc4f48uF9obaT7FZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756893734, "uuid": "512ed1dc-67b9-4e6e-8285-3879c95a39aa", "value": 11480136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756893734, "uuid": "733a6a5d-12de-4cc9-a671-11ff456fb5f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893734, "uuid": "fc8c924a-2b64-47b2-b2ef-2722cc372c9d", "value": "AXIS BANK KYC UPDATE cf3-2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22091837-8877-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756870570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756870570, "uuid": "c3f91587-b52c-45cc-8137-ec02ee267955", "comment": "Malware payload", "value": "b832a38c91a9e15ba8a53158760ea064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756870570, "uuid": "ec0e452d-8f7d-4971-ad6b-1cf42d77dc7c", "comment": "Malware payload", "value": "d85980b87f1018f1e88f393c08c5828cbbc6ec8c13b1f36dfa854a0edafb9edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756870570, "uuid": "2f0896cc-28cd-479f-a980-311ba2dd785c", "comment": "Malware payload", "value": "00e0750947e478307f2f5466aa1196e451cc74b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756870570, "uuid": "84a5d7d8-64b5-4b83-bf56-8da36d683347", "comment": "Malware payload", "value": "8f53bb843cf81b307fb4ff7dc8d714a55e1c57ec2cd55bc593b789bb47c417e79e748402addb1be8f01fbdedc71a7de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756870570, "uuid": "d29d3a22-0094-4889-bb8a-e3153d683771", "value": "T184A206BA17D400FCEA978AB1C8B17507E7B2F1062EB1968F40B1C9929F17993DD0CB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756870570, "uuid": "94e4c388-a894-4069-9a33-4f5fc96a9040", "value": "a99c8140b955e68a6f4e6b4c3fc8a6c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756870570, "uuid": "50935b2b-165a-47a5-af47-c6e5abe0ba12", "value": "384:bfNLj6Adba5OoeQ1FbtM5bKd92NSSsM4kTKLahx7N4EoqCm0mjtbwHQ9KpF1FVAk:jNL+R9MbKdM5p4kOox7N4+zJcPFVsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756870570, "uuid": "cf9d3c2b-b48e-4f7f-8707-26a4f7592e14", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756870570, "uuid": "4325e24e-130f-4595-9270-89962c1a512a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756870570, "uuid": "6d0ba5c6-d126-4d65-bcfe-a31d71640ffa", "value": "Bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42e7e63-8863-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756862305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756862305, "uuid": "22e08f35-a527-45ba-9267-0523e7f410a1", "comment": "Malware payload (Mirai)", "value": "f2f66a6d5badca136aa9f94b0bb7d568", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756862305, "uuid": "565fb980-bfe8-4133-a7c0-a72647e99d45", "comment": "Malware payload (Mirai)", "value": "d87a549353e032ff1d30e3659d5ac3df0b463962d55f3eed40773e0af6b584e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756862305, "uuid": "93d91ee4-54c8-4e28-babe-81fa88175420", "comment": "Malware payload (Mirai)", "value": "231f07819261ad92c4a43da89506bbe95e4bd9ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756862305, "uuid": "a1fa768f-70c3-4f32-9fcc-9b8fa5ccfe67", "comment": "Malware payload (Mirai)", "value": "8925e012b773aff828f40f5208bb9f1d0662659dfaab0043528f013cad355bf615a814d7d8c853e89fc1f0cfb56befa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756862305, "uuid": "a4a97ab3-ae8b-4ba0-aee7-9dad43178387", "value": "T153F2970AEF608FBBEC6FDD3305AA074535CD911B62A53B3A3474C52CB75A58B09E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756862305, "uuid": "b8498d9d-7772-468a-a420-480e3a5c5275", "value": "768:5STBT9pn8Jyhz5IvHpCioUwfZJzNoe28emNY05cWNXiRTVG:y6jT8pFET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756862305, "uuid": "5b6641ce-91be-49d8-8b42-427ca29a03d8", "value": 34580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756862305, "uuid": "bef86758-c44c-4d02-942a-1420b98add55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756862305, "uuid": "df34bf20-0ff0-4d1f-b50c-ba4c73f83c57", "value": "SecuriteInfo.com.Other.Malware-gen.14742291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4a01ee-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880814, "uuid": "af39602c-b34d-4251-94cd-b29a2f38794b", "comment": "Malware payload", "value": "d9bb204b96fa39dc4b5962ab1d1a0ae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880814, "uuid": "443bf82f-d31a-4620-900f-afdc75ce2942", "comment": "Malware payload", "value": "da39822489044563ebfed4b983e89fe6e6836e6d9230359b59daefd260857149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880814, "uuid": "8f9b018e-475c-4d90-9e2e-9915f50984fa", "comment": "Malware payload", "value": "2603602cd5ed2dd9715e73f142cfb2865ca45884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880814, "uuid": "fabf94c4-4ecf-4ad7-bd6f-64c4804b6a2d", "comment": "Malware payload", "value": "508362f72e3b06394ab9f3bab7456779928fe3cd4faaee9c99c33a9d5a37642bccdb18ef4b12b24d452370b5c90189c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880814, "uuid": "cb017c77-0e5d-479c-9d15-4005e60912cf", "value": "T132528E08F97654C0DFA31530BBDB252391196B733A1ACADB419491C2A1C5FFD313A52F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880814, "uuid": "5b32dc64-4edf-4366-a7ca-93d2756f1b73", "value": "384:Yt7FgpIGzG9Klbeuu6WFmh8AyWKfC5C5z:FVlbeX6We8XC5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880814, "uuid": "ceb27ae1-7a0a-4008-9dee-c13f76bcd069", "value": 13333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880814, "uuid": "0000b400-9341-4f03-acc8-909465089fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880814, "uuid": "c9ae0aa3-e4c3-4c6e-9b46-a68e33f47c1c", "value": "d9bb204b96fa39dc4b5962ab1d1a0ae8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2dae40-88de-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756915147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915147, "uuid": "a005df13-17ec-4379-b23e-285b5ff500c0", "comment": "Malware payload (Mirai)", "value": "e35d3037f44d4ded7c3b11153f8e0bde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915147, "uuid": "2433f0ea-237f-4bb3-a76f-7a214b0ce279", "comment": "Malware payload (Mirai)", "value": "da498da61bc9fe62c5b6e192d921f3faa76f0b154331e177de584db2a1d9593f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915147, "uuid": "4c4d7c75-3986-4d9d-a2b2-a796d823357c", "comment": "Malware payload (Mirai)", "value": "9a31ada7a0bc595e40a0bf18fd3fb4aa0d10b8b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756915147, "uuid": "8dbff20d-d2f1-40e8-a3c5-05dee7d8bacb", "comment": "Malware payload (Mirai)", "value": "da94dbd193636a3c3120044939c21bccf0823f13e23cefaf4129ce986be2a556542ae7251aec41a2466cd15ee4618de0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915147, "uuid": "a9f4b892-b92f-4d1f-816b-988454b03908", "value": "T1ABF37C72E4265E98C261C4B0B0A5BF351F53D1E942831FBA29B6C2B46483DCDB509FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915147, "uuid": "a08c1ba7-85a1-48e4-86cb-b89055c4dd28", "value": "3072:Y3TO11Pf3Eicn8nULWoJit6DQF0QWzt/vX6hh1HyU0B:Yj4PfWn8nQJitQ55zhvUyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756915147, "uuid": "0514afc6-92d8-434f-a0d1-371126ddc246", "value": 160384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756915147, "uuid": "8ff25f3d-5c96-4bcf-ba8a-e5ec1f0109dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756915147, "uuid": "d75e7d40-c080-45db-932d-d05cdbb4dd6f", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11faf3c1-8922-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756943987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756943987, "uuid": "b88653ae-019c-43a1-b1da-fe14517e18dc", "comment": "Malware payload", "value": "aa06658563c2c1233ef9646fd8ca9cb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756943987, "uuid": "8993e93c-3c91-47e6-aefe-cf9336ef68f1", "comment": "Malware payload", "value": "db2af9aa7d2cf4c444d8f0b19b0c8607a94bc725e1b648089d0b059e4bf44567", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756943987, "uuid": "d9945c17-2688-4b1c-b8b6-9dbb538133c3", "comment": "Malware payload", "value": "6fb177b9458ed1e8c60e66589624f152cb2e435b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756943987, "uuid": "27d750d9-8965-482d-9c89-63591f5ddb08", "comment": "Malware payload", "value": "79d66031467e5c045f7f8f8d7ec4f14cc0046a466113924f8ac2abe91a38bfacb5af69a70f27131f6885d5752dfb0d92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756943987, "uuid": "44669b59-c9c5-4493-b1eb-465208a410a1", "value": "T108B2D09015AA6560C370B43A5EAC895B76511BBCC2FB74383D914364F7C782C96BC7C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756943987, "uuid": "ccbc542c-f4de-415c-8f7b-d6d48333fbb9", "value": "384:/Z3hGzoe4hb7T3ZxIBcAklR4tmzIRFdg0TEMS/eMA/zAhymdGUop5hJI4i:hRq4B7T3ZXAMR2dg0TEMS/eMqAs3Uozy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756943987, "uuid": "0c4fa356-9698-4f2c-93e7-0109d7b20a0b", "value": 24060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756943987, "uuid": "daf555f2-aef6-4db5-a9fb-1e24f347fc2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756943987, "uuid": "96188eb3-78dc-4d43-b590-a49c8936c60d", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab32f066-8909-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1756933506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933506, "uuid": "3946eaf2-b8a1-4fe5-8c46-a034901258fd", "comment": "Malware payload (QuasarRAT)", "value": "54db4bcd3c3846802ab5cbca41a46fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933506, "uuid": "3c1c68e7-fe5d-426b-b6c2-cf26f2836223", "comment": "Malware payload (QuasarRAT)", "value": "db728098ee83742156ca473750c72cc14ea5d249cb61a1168009eacbd880c1b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933506, "uuid": "02bbc2e1-4068-43f0-ba00-1f97694c4e33", "comment": "Malware payload (QuasarRAT)", "value": "7bc38fd304e331cad9d055469d9ee42c6ea72a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756933506, "uuid": "a5cb179d-a8bf-4649-8c76-7f416d098ba6", "comment": "Malware payload (QuasarRAT)", "value": "defbb591934febd0021435a1530ef5d5ed0cd17efe38ef22d40bf27d98406e25a053a15d7bafacbd41efb62e71f92461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933506, "uuid": "bd9bf6c1-759b-4482-a637-dba0efec4a0e", "value": "T195E559143BF85E32E16BE2B3D5B0501663F1F82AF363EB1B6181667E1C93B505C416AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933506, "uuid": "5dd7347c-fe72-40de-a908-bb54389339a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933506, "uuid": "6853800c-0fc5-4923-9257-89cedd9c805e", "value": "49152:CvyI22SsaNYfdPBldt698dBcjHLpnk9hAvJ5LoGdOuTHHB72eh2NT:Cvf22SsaNYfdPBldt6+dBcjHeh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756933506, "uuid": "d6f63719-9f09-44ba-8d13-0fb1cfbe73d2", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756933506, "uuid": "472c1ba1-2393-420f-a44a-ade91d8c1a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756933506, "uuid": "c3fe6028-1354-47b3-83a3-83a9d4d10401", "value": "db728098ee83742156ca473750c72cc14ea5d249cb61a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e9b031-88db-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913492, "uuid": "2e28edaa-873b-4814-a121-9e6db4e95bfa", "comment": "Malware payload (Mirai)", "value": "5d461b738b8dbadcaae91363d49b4ceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913492, "uuid": "6b56514d-7198-4f89-aba7-426b7df62ccd", "comment": "Malware payload (Mirai)", "value": "dbb2e40bf2981bfa11e7b15221117a80148ba98a8f373c7bbf61752f4ccbe718", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913492, "uuid": "cdf94048-e4c8-44a6-b323-b66e9b1ff28d", "comment": "Malware payload (Mirai)", "value": "24cd4625cd0067cbb2ed51472dad8545303e09d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913492, "uuid": "331ad9b6-e947-45bd-b7f7-6443672e8695", "comment": "Malware payload (Mirai)", "value": "4c793657f1c8b35413da2a217fdb20cc8f676c281f7499274a99afef2545d1aca17d1f92216906236da3225ea1603143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913492, "uuid": "c4477271-05a8-4c3b-b593-13d8df140f59", "value": "T117230891BC829A27C2D41379F5BE998E3360B3E8D2CB7227CD604B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913492, "uuid": "a23287f3-f0d4-4516-945d-116c6e38dc2c", "value": "768:Z7bqxmKTeSIz9ygAGxAQ2k8g6ZQM8PHAmCuv/RWF0/MmUZ1mA2EDEy0eYjW9THvl:ZGmKNGxak8gq8HAmCuHAGncWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913492, "uuid": "0afc4def-9510-40dd-9663-323b844088a9", "value": 47092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913492, "uuid": "b9d206e0-6f4c-4c42-a42e-4101bc933a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913492, "uuid": "cd1f91ad-4f85-4e17-b545-3115ef6eeb90", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d8f1fb-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756872103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872103, "uuid": "72c0060e-2fe7-4899-81f8-1972cb00448b", "comment": "Malware payload (LummaStealer)", "value": "0f232ad37fadac8cde1b3fe637fe6c5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872103, "uuid": "e9df432d-8bec-44e0-9087-2b47d65d2763", "comment": "Malware payload (LummaStealer)", "value": "dca99af22ed2f63573268ac0c62424d9c7644ec7f6f54bce20f4bfebbef01edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872103, "uuid": "59014236-a378-40e0-a66d-7c15b4c1d200", "comment": "Malware payload (LummaStealer)", "value": "fa06e0f55ae33086aa66f7b67bf1f0fda0b7d543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872103, "uuid": "f28395ee-9a02-4ba1-adbb-1af1ef29131d", "comment": "Malware payload (LummaStealer)", "value": "dbd11399e90502663b9def02adf6462d2ef1d7c86bf7ecd334d8ea5e17cd42a847da2fd7e992d2aa272a7cb20ebe36ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872103, "uuid": "e284cb0e-19d6-4012-93f2-1608f56fe95a", "value": "T1D58533AABE1AF9FCF1C921FA4CE3F52C396C524E6BF35D01249401A94203E5E5719EB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872103, "uuid": "2d2448ed-4d5f-434b-9496-9e9a5866a716", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872103, "uuid": "ea958519-2ef3-4ad5-9da1-60c0f830490f", "value": "49152:St4/DRvHFMWqHLg5Lm2mszpOLZ88PtM7E:StkxHFMrrgJmh66dlOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872103, "uuid": "f5c78905-ca5f-4459-8255-358292bd4620", "value": 1758208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872103, "uuid": "69659781-3453-4971-aa50-d16a09a08ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872103, "uuid": "5a32101e-0ea7-4d39-8ff3-937b8f6cc38a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b34c1ce-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756891765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891765, "uuid": "6f45b459-c8ae-4932-b0b4-40f442c32ffa", "comment": "Malware payload (GuLoader)", "value": "922e262e58de4d10d3f663be5ed59194", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891765, "uuid": "9fdc772f-728d-4fe4-9a3f-974546c7d992", "comment": "Malware payload (GuLoader)", "value": "dcb3432bec7c79475146fa07bf058c4b478aac94e6bb611d541890a7a5fa942b", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891765, "uuid": "bae7be9e-e1b4-4a62-be98-52612e2bbba9", "comment": "Malware payload (GuLoader)", "value": "8bc7477657ad825fe1bcf9ff874c304416036f4b", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891765, "uuid": "69e02d87-e69d-43fa-83b1-36dc1bab4b52", "comment": "Malware payload (GuLoader)", "value": "62531a1115da04cbfe3d086c964cac154509bc8190574bdbb894b97a4e53eef7574c1eb73091392abff31c06ae8b2e42", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891765, "uuid": "6ac1a196-a5b7-47e4-acfb-bc59e9694ce0", "value": "T11463B5789FF0172D0D410A9B78942D54ACBC431543F1B0AAE5F81EAE883D6385AFADF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891765, "uuid": "9261c308-f4c5-4cc2-8505-049fa693a374", "value": "768:J8QY9uvP7vyfq9mXkg49xaM0LYkf+wo2Uji0CUpupX:Jw9uvj90k/WM0nA2Si03YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891765, "uuid": "cd0ec08f-5cb7-49f9-9262-829dcc197aae", "value": 68195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891765, "uuid": "7546cab8-c57f-4ff8-b9e5-e508804d9e02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891765, "uuid": "719296a5-4276-44e1-8f75-06c76f972744", "value": "Fedex ready shipment quantity for air or sea freight HY2W477M35050HA200_xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4188a7e5-88aa-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1756892527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756892527, "uuid": "ccd93a24-c5e5-454e-8459-090395f263b4", "comment": "Malware payload (DarkCloud)", "value": "6f3aced4f69a52dc82249d79ad57f132", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756892527, "uuid": "3563d7a6-e677-4b57-81a2-792f45c219a7", "comment": "Malware payload (DarkCloud)", "value": "dd2973ad690eefefe9ac0ca783447c62aa7ccfa814fa57fa00e1ae9ae51d0171", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756892527, "uuid": "0deca7d9-664d-4457-8eb4-8907e9d5fbdf", "comment": "Malware payload (DarkCloud)", "value": "1c3230e854d566d1b59774350e9c011daba1120e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756892527, "uuid": "5b319aea-de9b-4bb0-b042-4fdfbe82bcf6", "comment": "Malware payload (DarkCloud)", "value": "42894917decf98e56b497037610688e986275739771f388133f5d79481d3ef7ea3db53e3228a0f52fa75ad619822f4f3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756892527, "uuid": "4edcba1b-dacd-4d55-b95d-5aba1eea352b", "value": "T1792523843346D912E4E127B48D71E379172D3E995822C3878EEDACEB7976B0979C0393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756892527, "uuid": "de600da3-5904-4d43-b8c6-67971db217e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756892527, "uuid": "d63fb30f-1f08-46fe-adee-7cb066e8c399", "value": "24576:I/3T9DPtRyi7fj2wbxCvs1OMEu8X973wyNbBL:I/D9DPjjj2wb4968x3wyNbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756892527, "uuid": "bf3dab8a-8b49-4318-89d3-b2f42c076aad", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756892527, "uuid": "40dc40c5-cb2c-453b-aab9-382998424e5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756892527, "uuid": "aadc9d80-2545-4d99-863d-aa4c33d84f6b", "value": "NOTE.FORWARD.iso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6cded4-88b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1756899261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899261, "uuid": "5156cff4-42d3-4124-b76d-8ded8df74441", "comment": "Malware payload (Rhadamanthys)", "value": "f31c994a9c21dcff64c842660feae7f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899261, "uuid": "e56a84ec-160e-412b-9583-32272f9e7a94", "comment": "Malware payload (Rhadamanthys)", "value": "dd620aedd68431d93bf160121019e21774e7e4955f7be863486c5a699b1187c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899261, "uuid": "799a1782-3303-43c9-9f30-f891eaeac66e", "comment": "Malware payload (Rhadamanthys)", "value": "49848c214d70fb35a16d15be6f7220133740fc13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899261, "uuid": "8fe7124a-ea27-4b26-8a9e-5fc20d711984", "comment": "Malware payload (Rhadamanthys)", "value": "0fb1bd87cad1b59d0f3917494808ec76d1028650be14ad8d484cd5b456739df7d2118b34e0286bb0e014d0c9c98eddfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899261, "uuid": "f40b2b0b-ce94-4fcf-abf3-bb36d0aa832c", "value": "T1C9955B0764F728BAD67DD1760E613220B5323EA64331A787399D31AD5B72AE63E3D301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899261, "uuid": "dd7b16b2-6135-43f7-91e6-449c6ce67ffb", "value": "a520fd20530cf0b0db6a6c3c8b88d11d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899261, "uuid": "c93f2159-e0ff-4cfd-b1ba-b32f1376a57d", "value": "49152:g652TlEUBOqeRj25CKEtXWKk2Un7KG+9hu:m+qeRj25CKEtXWKk2Un7KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899261, "uuid": "d59f8921-42d6-4289-8180-4f40ed22e604", "value": 1981008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899261, "uuid": "4f48e4d9-17cd-4a1b-b48a-281e947ccbf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899261, "uuid": "2285250c-7dd1-4014-9bae-1a90bcdf9733", "value": "Boostrappbbler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd61a5b-889c-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1756886721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756886721, "uuid": "f90995e8-f007-46e4-bd10-f47d70119140", "comment": "Malware payload (XWorm)", "value": "9ceac91250b91f4a054a59534c6b7442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756886721, "uuid": "05fdd14c-70bd-418a-83d9-ee449faedbf1", "comment": "Malware payload (XWorm)", "value": "deb7e1610fc03728b90b589440b5d042dc4a38c6a55920211602355f44715e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756886721, "uuid": "549b040c-e308-4189-b7cd-338f3daf673a", "comment": "Malware payload (XWorm)", "value": "d555546b5034635e013292f5dca18a2f584d7ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756886721, "uuid": "fb9f358d-d753-4130-9587-f7ea92ffacf0", "comment": "Malware payload (XWorm)", "value": "a36e28ff7191f69f82f17ed8c542c7326ab55b0b619a6a4f21ab3a05f8a6569b06a531ffdd4e3d8945f62ab958ab6dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756886721, "uuid": "28d1ac1f-00f2-4dca-b98f-69cd83d4e557", "value": "T1D0A4F144339BD903D4B22BB45DB0D374622D7E9AB822D3074EEDACDB7976B016980793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756886721, "uuid": "00a3ea7d-d755-4411-883e-fdb877b83b36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756886721, "uuid": "78d8dc73-2ac5-4731-8b6b-ab97b67ab453", "value": "12288:ARh0OWJhG9Lj8U+3vws8oJRLZCN0NetbJZnW:AyG9k9/3fRtC6gtvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756886721, "uuid": "ce9cc9fa-373b-441d-8fec-bf3fe582260c", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756886721, "uuid": "3f983d6c-fc93-4e0c-92ae-c508e0a6cc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756886721, "uuid": "f934feea-0ca7-4d15-96ab-d7e6fde40cb9", "value": "ProductsRequested.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d408aeb5-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876022, "uuid": "8f805252-9da2-42fa-bc0e-85a10f8649f7", "comment": "Malware payload", "value": "80af7f268846e5620c85453fc535fb3b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876022, "uuid": "4b6759f4-1394-4fb2-8135-1a1cfebdc23f", "comment": "Malware payload", "value": "df2ef99ef65b2b741311c2c50b3c74bfe1093c732b26dbec4ca1e4fd6341c1ff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876022, "uuid": "34db18f9-d718-4bcf-9a0e-0d791b60b325", "comment": "Malware payload", "value": "b271699f36eba4f7271b372be182ae03d29e0388", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876022, "uuid": "e1e31d0c-68b1-4073-9c82-5a183ec174d5", "comment": "Malware payload", "value": "b99f75fe2be2fde2ae83ea2f312e403d023dfc632dbbe1c24c9b72e76f68a6685c93ab6ad4487d4b8d42502ea8ffb069", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876022, "uuid": "bc428f57-4a40-46d8-a519-d9ef3d00c6ef", "value": "T1B792E8993A7A99B66F45A9B0D36D0055306870873F07AC08F9CF847E6F164AC3BBC45B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876022, "uuid": "e40aa71e-6328-4f7c-8c05-7d4c6957f0cf", "value": "384:KDPZK/j6Mgm33XXxxuu5v5Db9R5qDR0/bjrZJxiBw51yP6SBwUby8GQx8b:ePZGj6MP3hNv539R5eR0/frZJxgw5GNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876022, "uuid": "e5fd8b29-92c5-4572-842f-c3b51ded0f08", "value": 20230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876022, "uuid": "fcbefdb4-c9d0-47b2-b17c-d0cb86fdf3e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876022, "uuid": "60430dfc-3e95-4f99-9e19-3113f184ce3a", "value": "installcallcenter_centos7_4.2_http.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee5274a-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880819, "uuid": "ff20e09f-13e2-4b97-bc9b-e488f699ea44", "comment": "Malware payload", "value": "ed2352a115be357c0098b775ba078095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880819, "uuid": "ee6679ba-4c9c-40e7-91df-f1193ad2518c", "comment": "Malware payload", "value": "df43e6a9e9e7e3369e70032a3f6605314ae219463f84c153f4b77116b4fba13f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880819, "uuid": "004fd109-a197-4635-9f33-4f3ba05c3de6", "comment": "Malware payload", "value": "88e83e94a05933f8ddb01aa4d084b64b9e0500be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880819, "uuid": "ea4c4d46-32e2-4ea0-9188-d8fae62f9688", "comment": "Malware payload", "value": "e8e8fae1cdb99e70682de67d07df92b456777e7e22d34d45d68b6ce3d205e2c533feadfe331c4d7a7f2fe7b3522ac1cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880819, "uuid": "ec4b08e0-dc5e-46c0-acc1-af8c9b843ff1", "value": "T100526C1BD03296D0DDF340725B64E6A0B122A923D87D73BA96ADC3862472FDD9D5F301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880819, "uuid": "e683189e-a5d7-4156-945e-92a711249269", "value": "192:T/neeXTyDc91BPqUov5OTf1B7iFh/o1Rq8PkgPlCpEKAqbP0tqj/c9WSa:zeeW431c5gN8/oRnPkmlCpnfDjm1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880819, "uuid": "0163497d-08c4-455e-a255-7ac52c61c49a", "value": 13333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880819, "uuid": "c74b8e59-9d35-4a25-820b-bf6c3f88ba79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880819, "uuid": "250bfee7-bf73-403f-9ff9-acfec51763f4", "value": "ed2352a115be357c0098b775ba078095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb7b5da-88f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756923521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923521, "uuid": "5c5c387f-9036-4d5d-a9b8-fb68ad005929", "comment": "Malware payload (RemcosRAT)", "value": "ff5559c895eb48f7ac4c3eb3a12747ae", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923521, "uuid": "bbe65edd-a0cc-4f05-8373-7e1bd65b9de2", "comment": "Malware payload (RemcosRAT)", "value": "dfd63ceb1b32ed35185764222f6c7173ba9d071d170ba77acc80952ca1d14ce5", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923521, "uuid": "8abb8dd5-2da0-4e6f-bbb8-65fdb2faecd3", "comment": "Malware payload (RemcosRAT)", "value": "3493315a614137761689a63199a492743d0cfe76", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923521, "uuid": "9efac0be-ab29-43f2-bd74-2710019ddb18", "comment": "Malware payload (RemcosRAT)", "value": "07334bad176144315abff4a76bd16233cf891cb14596d27e7b6a78b1b46f2901c0e10aa4d8ef2bd4f4cbd9036403f4dd", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923521, "uuid": "f8b88044-37a4-4a59-9530-6c13ffe3b480", "value": "T16E73A3289F9189A6C772AE655B10055484BDE021CCA150D965CF323B7B8233EFEB7BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923521, "uuid": "29222c77-2e68-49a6-ac67-154015bf51ba", "value": "768:CmiQHrMlReJ9dzjz5AfbXr7VgK53uULsIIkjCjljLYnHa4x:CKHrMlclFUXPaqeCICKlsVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923521, "uuid": "3835d34a-0055-4488-95de-cb9a784fc15e", "value": 79705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923521, "uuid": "f6235f57-2684-4378-82db-b580f14508b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923521, "uuid": "8cf661de-696d-434d-931b-04a33303fd0c", "value": "Container damage report file DC0123667 Fedex global shipping company report.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673f10ac-88e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (DiskWriter)", "timestamp": 1756916642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756916642, "uuid": "72eb29c7-7eff-4540-ad91-3c82126520cb", "comment": "Malware payload (DiskWriter)", "value": "0ba6a0c8c14f4a15c4c938fe6cf235bb", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756916642, "uuid": "efaa17ba-f538-4ca2-b05c-76b97103d0dd", "comment": "Malware payload (DiskWriter)", "value": "e06ec39af96172ded9451ea4fff09528271fba13717ce4d5f5bc8429c9941c0d", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756916642, "uuid": "899acfff-48cf-4341-a24a-40a24453737a", "comment": "Malware payload (DiskWriter)", "value": "f73dbe08a561235c433adf493a41e748c2d3c927", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756916642, "uuid": "068cc3d2-b428-4d41-97b4-365aa957ce1f", "comment": "Malware payload (DiskWriter)", "value": "e530a88014b451e26141fb9da3be281975e5d91d8bf41eeb20be56fcbeaab962c58b222db962f8348669b51a9533d23e", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756916642, "uuid": "2beca4dd-ae78-4427-9d20-d1cd1b77ce3e", "value": "T127B2191623E51CDAE273457AC4B2A5669571B9322F22E7DF0B90910A0F667F0FC3670B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756916642, "uuid": "e5b16bd8-871f-4684-8802-bc8c2613b451", "value": "20a769364125454678030635d624115b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756916642, "uuid": "8f614306-d3f3-4a41-80b8-3e0b3bb48f6c", "value": "384:Wz1pBL0p3AXil9C2cAnGVE4Wxr9GYGQGzG6rvesscxtu9Hv5HLFqbw:UBLcwXiq20hpS0eJW89Hv5HLgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756916642, "uuid": "850cba40-3a12-4c18-a921-552078bcc5cc", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756916642, "uuid": "b9f29d7e-0f62-4d8b-8567-b067f7b1f17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756916642, "uuid": "a1dd2e5f-311b-44e9-bbc0-120a88133e89", "value": "11414.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9504804c-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1756891808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891808, "uuid": "21d69a34-10a4-4ee8-969e-da63bf853a22", "comment": "Malware payload (MassLogger)", "value": "75285dfbeec0b4c75f74c9043f4f9669", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891808, "uuid": "09383757-c90b-49ee-b040-787752e1a3f4", "comment": "Malware payload (MassLogger)", "value": "e0c223c32b5a099b8be2c78731102f857ef5f9fb641a0e22542dd6dea5d125d7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891808, "uuid": "a6955c94-6cfe-4491-a72f-2a90294d411e", "comment": "Malware payload (MassLogger)", "value": "84619f95b99b705abac7111f02c1481bd8d668ca", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891808, "uuid": "c8163f4f-0148-4dc7-89a0-93e116a4310f", "comment": "Malware payload (MassLogger)", "value": "a2134427d849109fdd78576eb64335e6215c1b6ab0ec4414494dbfc6229ef466e4063c64a2edcaf9af91812aca56dfd2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891808, "uuid": "2b90c077-11e1-4d17-b39b-b260b1e617b0", "value": "T1A7B533B26A763D71E0B19233FD641EAC7761458889E1877EFD71F8043837E4917A0B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891808, "uuid": "9f80d546-7c87-47af-9b4b-a6e2c9b33662", "value": "49152:Z5Waz2rKW4LA13BRfhRIMzswLQqEN7zVeT1LH1jcyrFebQzoKCUfw:fGrZ13BRffIKswclN7zVMH1j0EzTCU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891808, "uuid": "3fa2158e-7e8e-44ed-8983-1bd9027af350", "value": 2311800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891808, "uuid": "50818805-1080-4ddf-81c9-5c6ea06d4a65", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891808, "uuid": "1b4d5c3d-3a80-4c22-bdd5-5d8c0ab31028", "value": "New Order 23.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01cfe0d-8893-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1756882861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882861, "uuid": "2e3d3635-8260-41b7-9f19-654caaf1a000", "comment": "Malware payload (VIPKeylogger)", "value": "3c576cf8efcf5554c22717dbfedb07a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882861, "uuid": "219d79aa-ae49-49fc-b558-326509594293", "comment": "Malware payload (VIPKeylogger)", "value": "e0ee36d6c22970ce0e918d2f93e7cdfb5571ce264138ec3b946e1440ff861ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882861, "uuid": "2c30f8b6-1593-4650-8c63-573dfee89930", "comment": "Malware payload (VIPKeylogger)", "value": "5dd7235e238b6a63615f7d5ebd2cd82d311b898a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882861, "uuid": "b681a7ea-0f3b-40bb-b3e3-aa3c7b08eee3", "comment": "Malware payload (VIPKeylogger)", "value": "306d4ff932cd2f5bf53f4b63bb812b458c518ea7073a49c61278bfc822410d5d03722447cf6a5bd435c685adc42f4cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882861, "uuid": "a0b0d3c0-a469-4845-b017-19021b91d682", "value": "T19B552303BA185B71EB6747727C2F1F181B923D7FE5A0129F2399BB0D28F11724A9B164", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882861, "uuid": "d0df46c8-5f76-4db1-85fb-24b6323c0685", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882861, "uuid": "71904946-0551-480d-b3c6-e2b6e4ee3039", "value": "24576:56GRbNQG2KMXaL7qqY8oVAULOC66v00sqI9RpE56VWOCDK5WW:bbKKMKHqO/pP6psVbW54CWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756882861, "uuid": "edb67449-5941-4047-b8b0-848c634a04fa", "value": 1323792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756882861, "uuid": "07c8945b-046d-4ba8-b35a-5a56a5e0f1b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882861, "uuid": "4f5c84ee-b735-46e2-bdd5-fbf3b4c9b10e", "value": "PO#XQCH1780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35eeb51-8872-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756868693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868693, "uuid": "1e14ec0e-9fb7-4257-8cb6-00aa65dedb1e", "comment": "Malware payload", "value": "96f70172f4f20181395e7af147dfa497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868693, "uuid": "b8f3aaf1-236e-4258-88fa-08b15e94b5cc", "comment": "Malware payload", "value": "e11f69b49b6f2e829454371c31ebf86893f82a042dae3f2faf63dcd84f97a584", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868693, "uuid": "0d5e0432-71bb-4644-8220-6ac664c7cd8f", "comment": "Malware payload", "value": "d60e484f8681bd4ca03c2632d2b9409ccc3e1424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868693, "uuid": "dd8d7092-74bc-4c66-a22e-bf8f911d874c", "comment": "Malware payload", "value": "791e993418e0746d34982aaadd490ab4eacfaa7457f87fc5e72fbe7d6fb60064d8ffc40a7e24c3f82641bb3098e1c7f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868693, "uuid": "9839d891-5196-474c-8fbd-8e66f49192e0", "value": "T166E2E703F090DDB1C4E25331808F992AE3E244A1DAA7DE07B90D46B4E79F3495B736B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868693, "uuid": "01105853-435d-4461-b57a-54dca2fb3e35", "value": "384:fgBuJMFEn33PW0X+AumAMZdRdbUVpDiJumRpRNc2cZ8mT4O:4/FA3PWRAZAMZdRg+vmZ8Gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868693, "uuid": "cc836186-6e87-4bd2-9836-d7ae96be90ef", "value": 32680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868693, "uuid": "382d94f3-e0cd-4294-9d86-a468979de849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868693, "uuid": "a9425665-9bf7-41cf-b228-f5ff4c83aaf3", "value": "ew_for_Linux32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a8ba2d-88f2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756923510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923510, "uuid": "711d5719-3f2d-4631-bc1b-91a7bd3c5cd1", "comment": "Malware payload", "value": "a0a364cd0859fe5a02f769ab1a4245f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923510, "uuid": "8c0dceaa-6edc-4c51-93f7-38ff9c579bc6", "comment": "Malware payload", "value": "e151eec4593cb06057ee0a43ade0b55509805f1ca3a686b4aeff1da57bfbdb0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923510, "uuid": "85f2b56e-802f-47ad-8101-a1b597480511", "comment": "Malware payload", "value": "58cee9a150c1e4ed7bf209a12e2c0ae335c48d4c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923510, "uuid": "96ab8832-5519-4f99-b587-1f4959eebd44", "comment": "Malware payload", "value": "67e27454f261ee9f0d7343cff4cf740ffad3e43c7aacdb4df6eb76e3e1a0a522c4dc917d19c434c17c3eccd878f78490", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923510, "uuid": "00f7baf8-f000-445e-8658-0d107df79ce1", "value": "T1C5F25DD4EF02597D0A42BA5E5C8D4A70C9ED4205896780A1F9CED31D9209ADCFBFC2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923510, "uuid": "e86f6c9a-0b4a-4db3-a967-759a9005a8eb", "value": "768:tEXhikH2jfOLB5UWG2hXglZS1qdp80h7YPEXpb7Hz87rjBC8PbrH3:tEXPgqB5bzTqcYEgxTYEwbz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923510, "uuid": "681c648f-b08c-4b05-aa32-d69ae0a6a44b", "value": 35345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923510, "uuid": "12726d92-fccc-4c6f-b113-5bc4ce213ddb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923510, "uuid": "f713b80b-8886-43af-a09e-27665f2a2fe9", "value": "2025-09-03-0803.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deefbe27-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1756923285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923285, "uuid": "cfe8f138-4c2f-45b7-a11d-d2dc97dd77b8", "comment": "Malware payload (DarkCloud)", "value": "6beb73a93c1fa45aa51b0271a8780d58", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923285, "uuid": "5798a4b0-7c1a-4c7f-86cc-55f33fc1cac6", "comment": "Malware payload (DarkCloud)", "value": "e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923285, "uuid": "855e2a31-661f-4306-9ac7-d0ef24a34c7c", "comment": "Malware payload (DarkCloud)", "value": "c374a2c18395824613c3f289c950114ca6e30cba", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923285, "uuid": "46da2ddd-434f-416b-a4df-6bbceb6e4fe3", "comment": "Malware payload (DarkCloud)", "value": "3b6a607bf922f083e8a70bb285fd0b5cda0cc1e505e7840ef9bc31e3872931d8972fe7f7d0b3094a06d9cb7320ef5561", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923285, "uuid": "e000f396-6dc5-4554-ba99-d4cd19e433ed", "value": "T139E35343E31B5078D4F281B3BC37579EFEA0009F32A5A501BB4CC45A5FB268EA776649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923285, "uuid": "fbe0f274-af62-4ffb-a092-04a9cc861a3c", "value": "1536:b/1vrOVrnGCdaLafKgtry1tZ9FqUetPyfCaI0nJLG1zZfPxgVVYHq5mHTO3UxT:sGSaLeWnZ9FqUwPyfCaI0nB3UxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923285, "uuid": "deab103d-4273-4031-9524-5f5b32b6bd85", "value": 143659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923285, "uuid": "a67f5d12-305d-4008-9f17-e3678221ef22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923285, "uuid": "8981f48e-6d5a-4b3b-82bc-2dc529c9791a", "value": "mondayfiledloiddarkcloudxscript.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867a0607-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872886, "uuid": "72a4d08a-9bec-4cd8-9294-b3b153b188f3", "comment": "Malware payload (Mirai)", "value": "cdf3d3619d49b6b9fb57dc4448f6089f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872886, "uuid": "a4f38d79-9fe8-45d1-b8ae-6d551f2d9ba5", "comment": "Malware payload (Mirai)", "value": "e268c47d7b6fdc1871f03e3b9aca8efa96d1292f99b0178f08f5b783f9fa235a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872886, "uuid": "46837370-0c85-498b-bfb2-4961fdd300b1", "comment": "Malware payload (Mirai)", "value": "b1e0500b04babd9a5a5ab1c855b20bdccbb6ab1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872886, "uuid": "3580c069-8f4f-436a-b26c-c85844777b3f", "comment": "Malware payload (Mirai)", "value": "036d5c297992d9cc62c74a512e1abc3b1d6c484536abd722d39aef3e6ec758b3b39662e318b58d9e872d17c646d6b15b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872886, "uuid": "29591854-61cf-48ec-88dd-8792eb62acfc", "value": "T165F03CC9A2A145E72CD05E4AB562481A305BF54A04C94F88E9CD31FD58ACD85B011713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872886, "uuid": "e55ba18b-a23d-4388-b226-5b75c15e23a9", "value": "12:GLlxM+c/255YLt2c/2naDYLOc/25wkYLC+c/2icn:sAd/25ctl/2naGt/22Rs/2dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872886, "uuid": "57ef463f-3090-478c-95b0-779513408b6a", "value": 563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872886, "uuid": "192afca3-9dca-4b9c-bfeb-76179e4139be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872886, "uuid": "5184d573-4586-4905-92f3-f51df578be85", "value": "nsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4666ec16-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866765, "uuid": "0ffb1aff-74b9-4629-8cf5-1330820efb61", "comment": "Malware payload (Mirai)", "value": "839f5175dac1fb2f2f6bf765ab726f6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866765, "uuid": "5f5239e3-5177-4078-8860-7ef3bd1a517e", "comment": "Malware payload (Mirai)", "value": "e28f3c7821bc62db7b34af016ed43fd7573657e4f83c626995519124771e0c90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866765, "uuid": "478fc76a-3556-4c80-856f-bab289d27b84", "comment": "Malware payload (Mirai)", "value": "b5fce3ca9d0a022f706d9442452b0b4ea46b9bc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866765, "uuid": "d5ba4490-0d13-43db-a413-5724c36dfa58", "comment": "Malware payload (Mirai)", "value": "7b89674ccbaa84ce6eda9fdbae4510a8f0f3cf4e9180ca2371075e5bcf8397c686008cd76e0315cfda32eced7bb69249", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866765, "uuid": "fb253f32-f1e8-4846-84a8-5522fa0ab480", "value": "T124B23B829A87D1F8F50011B69076A772EF32ECBEA409EE4BD3A4DC3A5954C10B71379D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866765, "uuid": "3cc73bc9-cac5-472b-89e9-a911f0a6c041", "value": "384:fd9c1NvtUyD/NJ+1FRmQ4RVCD0Dt1YvpmAfewf1Y5r9n/8l7ZV5stNy:jcNvSCC1FMrYvpl2wfw/8l7ZVCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866765, "uuid": "5ea2fe23-5db9-4a44-b4b6-2787663eebd0", "value": 25164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866765, "uuid": "e091d619-df93-4c3c-b9d2-33972ff9ca62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866765, "uuid": "8fb70e94-7b72-42fc-a5af-a85358ce1746", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b63a98f-887a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1756872035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872035, "uuid": "c1e1d367-346b-43ba-81fc-607bf7cbeea4", "comment": "Malware payload (Rhadamanthys)", "value": "7639c60353b9bb93c64192101ca60f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872035, "uuid": "80c7b78d-42e4-450a-8aef-a16ebfba42f0", "comment": "Malware payload (Rhadamanthys)", "value": "e2a94c188a5479f2239b8cecfaaba3c0fabffff51538727cc5b0bd9c8e059818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872035, "uuid": "0b8fe38f-69c4-4afe-bbc6-e104f5e66d33", "comment": "Malware payload (Rhadamanthys)", "value": "f57ab229258da3024cf729851f7ec09017bacc6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872035, "uuid": "2b041d27-6ba5-43e7-91a9-af7f981ee1c3", "comment": "Malware payload (Rhadamanthys)", "value": "0facb4d58f3bd6b77c5e0ad97407b3e416e7b510719d19be9b6944bba5fc144cc17aa761e9c5c1bff417e6f984f56013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872035, "uuid": "bb340b18-953e-4642-a15f-4ef0ccceabdc", "value": "T1B2151242B5C3D0A3F7A304302E34EAA49D3DB6A27F215DE77198056C4AF99D7827352B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872035, "uuid": "5c8a7dcf-f341-4a84-9736-e70767ce827e", "value": "7ccdf26f81c5c13d798e8a7ffab09084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872035, "uuid": "efdff7c7-752f-42ca-a5c1-e556bc2f7bf4", "value": "24576:Z2HdJsviS8xGGBf5BSpjqxqS+qP/zMmLHu6P1fkXS:cHdKF8sG1jSBqxqS//zbHpfMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872035, "uuid": "c966dbdf-7d24-4f87-ae7f-edc2f7ac5aba", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872035, "uuid": "68e0ed4d-9a33-45d1-9e4e-3403ee2bd908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872035, "uuid": "d3c0d87f-7147-4cc4-b616-a132a141d82c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0f462b-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872684, "uuid": "350bedb0-7f2c-4830-87c9-6f6fb4ff5234", "comment": "Malware payload (Mirai)", "value": "0f5cd5ccef2029b86f6f77bff188cc32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872684, "uuid": "db472f65-0181-4982-9515-cb33561381fa", "comment": "Malware payload (Mirai)", "value": "e33571a62bb64341b3951872140c4b4554a7cfbf0901d734274cf12ac861ddfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872684, "uuid": "08186bb4-8893-4f6e-adcd-3159ffc2b078", "comment": "Malware payload (Mirai)", "value": "f868ef1a0ddf2d29e46c5767054ca675f55b4c0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872684, "uuid": "585c5508-5cdb-466c-a96b-905a1dcd5a9e", "comment": "Malware payload (Mirai)", "value": "e657a084cdb2377b24970e0414cadeee29a63ff00cd8afe6410a806b3bb588db40974c449f4f783c497e238079a76d58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872684, "uuid": "56f3287b-dda6-467d-bdb0-311c622293f8", "value": "T1A521EF7BFBBB8B16C860E1364EA3A3147660DC8C0014D26AAF617A1DDC127616F562F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872684, "uuid": "90608fac-3626-4476-8d9b-4524c789bfd6", "value": "24:3jvDq3N0yTK99ke/C8MZQXhCrjSkvySJ9lo7pNTawqFk:XWVTW5C8MNDvB9+7pNuPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872684, "uuid": "3e9458c2-e672-4bb6-a151-f799155bda5b", "value": 1272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872684, "uuid": "1c56931f-bc46-4b61-87a6-98183e354845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872684, "uuid": "f34e7813-06a6-4e02-8092-bbdb8a8c6542", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2976ce73-8892-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756882179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882179, "uuid": "ada75736-c850-4860-9833-b36f9db18ff0", "comment": "Malware payload", "value": "6f5c27dac54791883e57141950ee4f2a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12656791", "colour": "#3899D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882179, "uuid": "bc1e9916-1413-4766-94c4-16116664f12e", "comment": "Malware payload", "value": "e43ce0ce876d35b6e80206077fd36b59e4e9ae137fb754b9d3231f77ff34e02a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12656791", "colour": "#3899D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882179, "uuid": "e5e90081-0c7c-4064-b4b3-374e731cb3f7", "comment": "Malware payload", "value": "f39780029fe1da018d1e074336db6445c8e3a212", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12656791", "colour": "#3899D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756882179, "uuid": "0c0d5a36-a8d4-4d9f-a1ec-ebe50f6552c8", "comment": "Malware payload", "value": "de3f2966e18a589bba53ecbacd543ecb8aaf9b160c65322f48695f5017ef00c41acad0ac3916ba9afe02b93afc920d41", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "tmpfiles-org-dl-12656791", "colour": "#3899D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882179, "uuid": "86a342b2-6ccf-4c8d-a821-a3b6ce97d774", "value": "T15153FF02E75C048D225980BEF24194F6F23E9A41547BA7F2A2D6104D1FF5D68BFBF8A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882179, "uuid": "33072735-1505-4136-bf51-3e442539ad8b", "value": "384:ZF3mivLhUjCBhSjCB6aynPTqVrAnyGLj8IcxVX52msJB1u+kuZtE:RyneCISKpKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756882179, "uuid": "a1d7e95a-4650-4f56-a7ae-9fcdb9b23637", "value": 60685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756882179, "uuid": "1647ad18-fbe8-40ac-8481-4dff975652db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756882179, "uuid": "42bb3852-76ab-4736-a020-931a538ce067", "value": "x.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d565d1bb-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876025, "uuid": "79aec909-8490-4b83-a5c2-21acf4deac1a", "comment": "Malware payload", "value": "954ba5a79c67abdc5d91d0d83140c768", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876025, "uuid": "f2b8cd1b-aaed-4f0f-9993-611a26d4f8ee", "comment": "Malware payload", "value": "e4427167f7926e7aa0011770cc262cbf1cf1c2e554c257231e20bac994e4fa94", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876025, "uuid": "dfea75ca-db56-4c9b-9ae9-9cb701cf33f5", "comment": "Malware payload", "value": "12c8d55af7e5dcf356d22e679c12e5d7ecfbe684", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876025, "uuid": "f5249624-9607-4c59-ab90-25b579188471", "comment": "Malware payload", "value": "467959c934e7324d84f5f1fb3ba326ca4e911845898ee001cdd00eb2a25ba94c84ec9572dd1470c169d934d88b501213", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876025, "uuid": "0b7bc01f-f174-49e0-b0ba-98eba0bda068", "value": "T12851B04E10265392CF086DECF2E74CA8A00C5390BCBB2BCDFEAE5A9F5511486706F907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876025, "uuid": "a1438979-aca3-4a2d-978a-a4314c2a0e9c", "value": "48:OMds+ZxB9npsYV9aXXDOl4TETNMbi9cII+OPexIxtOlb+TJvd:1B9npr0h+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876025, "uuid": "46e6aec3-fecf-43ef-a98f-0fbe59c06b34", "value": 2723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876025, "uuid": "0a00ba2c-2d4d-42d8-b825-4fcf9cd9d303", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876025, "uuid": "cc2c0178-da1c-4a4f-8011-0c0538560094", "value": "download-115.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc283f7-88ba-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756899691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899691, "uuid": "e9d12f19-84d8-4fdb-8bcd-056aaa4a86a9", "comment": "Malware payload (LummaStealer)", "value": "0992d86c6e01e3016153e3d11f8d7691", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899691, "uuid": "83fd487e-d4ba-4e70-9e86-83e10573dca3", "comment": "Malware payload (LummaStealer)", "value": "e4712909e4e35fb83900083aa057d72acb87f5d967d0f6a8db6b2a0a0c37ba63", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899691, "uuid": "7c1a4a19-a979-4fed-9b58-63765eb714fe", "comment": "Malware payload (LummaStealer)", "value": "e381f1120c7149d56a955cf18a6e13a84c5f7085", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899691, "uuid": "e11e19df-30dc-4cd4-8eaa-b299672acbc8", "comment": "Malware payload (LummaStealer)", "value": "3319aeed198ad37d87f1ba7f1d3de7a3b3d340e456af80fdef6dc95a4f5d8f85b6c228e2648eac18bde474fcbd113fc7", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899691, "uuid": "539c7065-0700-40fd-b370-36023462575d", "value": "T1A635231E1AEAA4E6C7D01473A9B2C79982B1FD52EC27871F97953EEE3C110818E11377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899691, "uuid": "88721917-737b-40fc-8aba-052cdc6fa11a", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899691, "uuid": "d7082424-209a-4855-978a-872d0896a5cd", "value": "24576:SGy8HYoZJ3nzFD1+NDB1cS95JSOmTxDQlEtu+DylVhNC:h0qJRDM1BXPJIdcH+s/NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899691, "uuid": "782cdf85-6196-428b-91c9-f608f6680cf7", "value": 1127328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899691, "uuid": "1bd16258-4939-4a83-ac60-89e40fe534f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899691, "uuid": "6e2462a0-1a76-4515-a074-4ecefaea1204", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e2f7c3-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1756891806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891806, "uuid": "9424a180-f810-4df7-a7f1-1620aa868093", "comment": "Malware payload (MassLogger)", "value": "a435fa1de1c84c81d5b29d1fa002c37f", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0798", "colour": "#B6F667", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891806, "uuid": "5c0993fd-f18e-4a26-b1ad-ae583a5d4d95", "comment": "Malware payload (MassLogger)", "value": "e4a7f4d17ae4f392713b90b301313b2976b9926d6d2784ce02079aa04ccd8bd0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0798", "colour": "#B6F667", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891806, "uuid": "652f98de-f6e3-4384-a927-ea9f7e439ade", "comment": "Malware payload (MassLogger)", "value": "06081a55fa8d1d047b991472bead409325a15375", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0798", "colour": "#B6F667", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891806, "uuid": "0eebe1b4-9a36-4bc0-adcd-b71101f0b6be", "comment": "Malware payload (MassLogger)", "value": "39d67e942f6542b98bc8b7ea3f1dd3f70523212fb55d725c83874a00aeccf38a43d91e4f379d468c79c0431a3e25e09d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0798", "colour": "#B6F667", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891806, "uuid": "5cd8ce7f-c905-407c-9368-700ef173fdb3", "value": "T140B533616D3D1270E8AD8A62717E6A7CB032270D4FF54BBDFA72E010E47876D72D2261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891806, "uuid": "c9942761-d76a-4cad-bf2b-08ae3aff5e4a", "value": "49152:ofzhfmz3krdLh8yJfbIifCkrD8/1LrtVlPvQKnNC:0h/dl8/ifJv4rlv3n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891806, "uuid": "2780f703-f040-4bc7-9ade-e4c2393a97fb", "value": 2300299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891806, "uuid": "9a1f80ce-f3e9-4f24-92c2-69ccb985f1c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891806, "uuid": "0b18b950-4df1-480c-8c57-82852b887f74", "value": "New Order RFQ HU2500357.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a057107f-88a4-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1756890109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890109, "uuid": "387a453c-b65a-4249-a6e2-02acb27da25c", "comment": "Malware payload (SalatStealer)", "value": "e2eb6dabce55dc32fb40be54a5f1242e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890109, "uuid": "6f19444b-c1eb-4fb5-98bf-aaeefea9d94b", "comment": "Malware payload (SalatStealer)", "value": "e62f4b4815b88516c2bfe167fe3b12c3d253a914d386b835ed0f3c3f5b0bd7c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890109, "uuid": "d95640f8-dd58-4e91-a650-7643921dc599", "comment": "Malware payload (SalatStealer)", "value": "8a12f2ec2cd0cc22ecd5add4d732936c692595c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890109, "uuid": "9d91e5b7-f6f1-4c35-920d-d4de02df7872", "comment": "Malware payload (SalatStealer)", "value": "2211a7199c36c4c9bf397e3f05df915b51f12ebbce4590b8a449d08b67c56f346f4c25d4aea7b4df889eb59c0a7b05d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890109, "uuid": "d997299b-9687-49f4-8e2b-4b5afec6ef9e", "value": "T1F1E5334B5E96916AEFD8B0FD90FD713384682319057D23C26E3C3C7A921F79B260499E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890109, "uuid": "32bd8778-2dc6-4ba4-88a3-ff5473acc408", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890109, "uuid": "9226f89e-40f7-4c36-8fc3-6f6e3389e4ff", "value": "98304:C1A23/emSfsQovepInCkR4PKjn5/2aSA:C1AsWmSUQ2epInCkR4qFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756890109, "uuid": "555fe59c-678e-4dd9-b5a3-41e58e9c3889", "value": 3288576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756890109, "uuid": "c467768e-5bfb-4dfa-99df-a494c6fff076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890109, "uuid": "22746295-ac05-40f0-85cc-84bab40885d3", "value": "e2eb6dabce55dc32fb40be54a5f1242e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c16503a-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866775, "uuid": "8095c9c4-1251-4ec5-b902-1045040ade98", "comment": "Malware payload (Mirai)", "value": "f5dbcab39f862339475894d7cf5cbc68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866775, "uuid": "eb8600ef-7fc4-4763-91da-1c51aadbbb2a", "comment": "Malware payload (Mirai)", "value": "e74d6b474a73f8ac2cd2e1bf23a95f6dc982a5a523a893756e08d1f856340888", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866775, "uuid": "1dea8571-9e4c-4faa-9002-374a7b47c738", "comment": "Malware payload (Mirai)", "value": "023100229cd478045da20c6d650ea5087c89433d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866775, "uuid": "2b943abc-4a12-4a2c-a328-b47a3401849c", "comment": "Malware payload (Mirai)", "value": "5d068eb52f11e6690f91689bb31a6d4aa99ef33d78cd2d1f53f9643c025edce69921c97a07707698df540b5613bc338b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866775, "uuid": "8443daea-73a9-4d9b-8adc-f0f929ef431f", "value": "T1B8431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866775, "uuid": "b3d32e51-4d4f-4845-a3b2-ed65771f774a", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwl:RqtmZPuutfbltZFBSJsBcfDSTFI+BEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866775, "uuid": "893a9a18-88ac-41c8-a5d5-d933c23c7c5c", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866775, "uuid": "56aea8ae-41a7-4bac-b53e-112b18f4c638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866775, "uuid": "70efbe13-2c44-455d-94e4-e7731d4c8017", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e40bb2b-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929968, "uuid": "19fdd489-0478-4a59-9670-c43ae4be3cbe", "comment": "Malware payload (Mirai)", "value": "a16a847f4a32520cd030d7740a05d888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929968, "uuid": "f62131e3-87eb-4ea4-b82a-b998d6d06839", "comment": "Malware payload (Mirai)", "value": "e76ad9b5ac59b0738e4b03a9261e65e626bb3c194a211b2ab16bcc0641da1466", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929968, "uuid": "60906c30-3bb5-4f8b-804e-dd720ade1f3e", "comment": "Malware payload (Mirai)", "value": "20b1464d9e595a660b223a75e68bde90502303e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929968, "uuid": "f82e8c19-1e7c-4217-8646-ad325a62aa6d", "comment": "Malware payload (Mirai)", "value": "615e170578fe1690d2cdb69df48512334e1d70cb2226b3a443ab63658ba029a847d72d42d7f0bbea77b141b1f366ca36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929968, "uuid": "a76ed95e-86ff-41d6-be7e-60f85dfe323c", "value": "T1EC63F756B8918A11C9D513FABE2E118D331353B8D3DFB212DE106F60778A96F0E7B852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929968, "uuid": "135a61b7-23fd-4703-8351-68dbff2713da", "value": "1536:mZnGzZgiMwlRQAbTfKSBxkVmHAiczK78+ZVCEHNBD/yrGerALkIziiQazZWO:5d70AXfK+umhczKzVZHNBD/6GXQazZWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929968, "uuid": "7bce4e0b-a545-495f-8d50-830e688a8512", "value": 70948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929968, "uuid": "73f5cbe9-f4b4-4b70-9462-50f12adceb94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929968, "uuid": "1c1821ac-d073-43aa-a810-27b0d556b61f", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda91a4b-888a-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1756879018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879018, "uuid": "617790a1-6471-46a7-9ebc-88640c636bc1", "comment": "Malware payload (SalatStealer)", "value": "d8e4cecc57dd2c846d3b1e5725a10c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879018, "uuid": "6d2b09bf-06c4-4c02-b553-00c2def2cfa0", "comment": "Malware payload (SalatStealer)", "value": "e7b188c6d45bfa86305ed3932a87b1780d114571d5b19aed4ed4d1dd66359382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879018, "uuid": "ff355afa-b0b8-487e-9004-5d46ca7a714b", "comment": "Malware payload (SalatStealer)", "value": "c4830452ba1dffad3567835f613300d45b7466e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879018, "uuid": "177bb98e-aa76-40f9-975a-59f078695c8f", "comment": "Malware payload (SalatStealer)", "value": "8394096d15cdc12c3af17bd755f04668fb7b5225d34aaac195784dff5c685dc842dc6fccbf1b24f61856e34f46e7f27a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879018, "uuid": "570a2c42-00b2-436f-ac46-1c087543d7ab", "value": "T136F6331862AA09FEECF2D93E86627C00C2697D417F69C5DF439413412D376EA5A3B3B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879018, "uuid": "e668388d-99c0-403f-9e27-e59c6383d9a6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879018, "uuid": "e87f0dde-e355-421b-9ab9-5a345b9ae112", "value": "393216:BYESC+2NnhKatSdOOy1SuCq6mdUSCb5oy1Pa/wwDWtOA:BYEbhpS43Cq9qJqEP6wwDWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756879018, "uuid": "287e8a50-1067-4048-b747-8608ea9ebcda", "value": 16289322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756879018, "uuid": "5eb3e525-9da6-4e3a-9fd5-bbf34ea87f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879018, "uuid": "5dc9e099-331f-4278-b8e4-f25e83088618", "value": "d8e4cecc57dd2c846d3b1e5725a10c41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9324fad-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894016, "uuid": "0d6ff79d-50df-41ff-b6cc-a49627c69c1b", "comment": "Malware payload (Mirai)", "value": "0c7e8ceff3aa091ddf3f232a58ab0f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894016, "uuid": "9be494c9-e90b-401f-b695-9fc41c372fd5", "comment": "Malware payload (Mirai)", "value": "e7b1d9504e3f6186d5c26f39932d0327b4ba22e04bf6e32e78ae72ca6969bd8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894016, "uuid": "8162f269-7602-4dcf-ad69-60721765ebbf", "comment": "Malware payload (Mirai)", "value": "5c301310aa2617d38de2a9de5653ef7006e454cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894016, "uuid": "75d4635a-a0cc-4b5a-8cad-157e50408a12", "comment": "Malware payload (Mirai)", "value": "1b105f0970b247a1cd477ca9a37f3bf3eb18a0010217b61a9f38e23e932aa4d1fbb27aa839cacda7f9e66d6fa864dbc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894016, "uuid": "2ece4c96-a6a0-4809-b4a9-d43cad4bd89b", "value": "T101E2F1A3A3729452DD7C7BF2E86988CA67BC4B6CC6BBB0A3160553182A570535F3C493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894016, "uuid": "8ac58dfb-3e03-4553-a649-a47d7740f3d8", "value": "768:uoiWiO031vpAPbrVWZK3XVGxm9Xj1nn9q3UEL5Im:uorm1vpALgUJ5n2LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894016, "uuid": "1ad2d686-1ee7-4fc0-8c34-657c63606c02", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894016, "uuid": "899a3727-abb4-4804-b408-4b86b3e37683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894016, "uuid": "52c392c6-d42f-447d-b080-588c700fdab5", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b23c00-887b-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1756872616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872616, "uuid": "c4bf1dd0-f95f-4bce-9cd5-0dff69de76ce", "comment": "Malware payload (ValleyRAT)", "value": "0c658e8899764e225571d4cf72f5a8db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872616, "uuid": "f4ebe7b4-a637-4147-b250-1fac757d87ec", "comment": "Malware payload (ValleyRAT)", "value": "e92228707cbc2a07b773bd2bf2c68f90c3df82fa35d9e439aaa30c4857546e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872616, "uuid": "fcf6c8ce-802e-4ccd-83b3-97e77f54466c", "comment": "Malware payload (ValleyRAT)", "value": "54b055588f603d112f664586ebd8bbfeb5583f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872616, "uuid": "67547208-e893-4db4-9ab9-47aeeb2971a2", "comment": "Malware payload (ValleyRAT)", "value": "d5def1bff2d5edd98a7dbf5a9b8061031fadb75bd8105e8fdcc5a632e02d50336d22492fbbe4842a37ed8a48b406ae79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872616, "uuid": "285d77c2-3938-4eef-a6d1-b6a22d6318b8", "value": "T1A0948D11B4D08432D5AB153A09B4DB765B3FBD308B516DCF67844E7E8E302C1AF39A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872616, "uuid": "3f2cac54-3047-4740-95db-b3efaecde9ec", "value": "ce09579c3721886d9041e964bc6aebf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872616, "uuid": "0e7e1abc-1254-4ed5-8768-8dd9dea0b9f1", "value": "6144:vIxfbhbmu7bT/h9ft0eyNV5hFmtsexgI6QkUIcbpO5zxP6:vIdIebT/hk5VXelc7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872616, "uuid": "0e861133-c5a2-4c25-aadd-074d956a7d0a", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872616, "uuid": "64955a94-3a7f-4fa6-9374-7dbfc9e81c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872616, "uuid": "a68a5a86-a887-4d17-b4e5-c4efb663ada2", "value": "e92228707cbc2a07b773bd2bf2c68f90c3df82fa35d9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8654ee9-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756923221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923221, "uuid": "38896847-92c6-45e8-bbda-64489986b310", "comment": "Malware payload", "value": "5e8b24ad82767d2d2865cd2de4d1d8e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923221, "uuid": "be8e4ec6-5765-4a32-9be7-0d5dab194338", "comment": "Malware payload", "value": "e93683f61cf5f0bc491d7c7398d925c9ad340cfdd45832d9d6c6ebf4e1c40ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923221, "uuid": "07b7af97-4323-4165-80cb-6666fca4788a", "comment": "Malware payload", "value": "ca891c8ec257d3246b5f35dd58aeba68e573df7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756923221, "uuid": "9c139cc7-2d89-4a13-87b6-88c48b1cd7a2", "comment": "Malware payload", "value": "9d32475ab6b412eed29884b389b0ecf7f9d043e48a839898b25d755df0a9d9543e6738bc9f6def724fdf83072fb12ba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923221, "uuid": "0551f815-2edd-4008-abd9-b76579eba20f", "value": "T1E646CE9273879C39F0996B32056290907CBF6AD1F8D26ADE96EC706CCE390511DFDA06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923221, "uuid": "7e225c6a-718e-48c1-a15a-75d8abd11544", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923221, "uuid": "ebf04ed9-37ff-4412-8257-bb831f03e135", "value": "24576:UawwKusHwEwS3bzFG0IeGib17bca7Zun7/yiyam5p5gneRXcE37XuzdG9VIqm8wQ:UwREDPe49ca7a/ytxgneRXmzA92s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756923221, "uuid": "b6110660-f7c6-4f45-8df0-e012fb64df72", "value": 5462301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756923221, "uuid": "b8406d3e-d93b-4baf-b292-d497004484da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756923221, "uuid": "7e03bbcb-62da-4098-b93a-e6b57f95bcb2", "value": "5e8b24ad82767d2d2865cd2de4d1d8e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc2ce43-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880760, "uuid": "23b17858-23c5-4af9-b004-53d17d9cc2b6", "comment": "Malware payload", "value": "875265e7f7607c176b79ce594bd346f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880760, "uuid": "4a05ed52-d485-401a-a146-8b7cfcecacb6", "comment": "Malware payload", "value": "e9637b8a8e9594cf2e9b38c7c21a9cb673f7e008a104d6248c277a9abf0d3847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880760, "uuid": "4781f30d-625b-43ad-be16-0016fe9fae21", "comment": "Malware payload", "value": "673966671a216b26dc5a8e1e1ccbd9d80d152725", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880760, "uuid": "55320da6-7c73-4b67-9a15-c6c88ef57cba", "comment": "Malware payload", "value": "896ece0ee1bc0595e6d4492cd5b5ce742a53ccc72fda5b424e786e862ebb96ed491971e1880f81fc71d08da5b4db011f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880760, "uuid": "35b37987-cb5e-4242-82ff-79ce7b33cda3", "value": "T1B0A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880760, "uuid": "ae7ea450-dfca-4d46-8cb2-8ac4488fc201", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPj4Ss:FOuhPHCKsqZ9YfM6g23ZJL4Ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880760, "uuid": "299d67e8-49db-4656-97a3-c60cf8ee5c3c", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880760, "uuid": "98171c1f-305b-4b62-9d05-a7b135f0e2db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880760, "uuid": "13fb0d87-5102-49fe-9733-53a2671aba03", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d530cf-886d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866524, "uuid": "49bc5754-6e51-4630-aed8-59ccf0d43770", "comment": "Malware payload (Mirai)", "value": "56e951e284390ad484c8e1038c7bbfc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866524, "uuid": "40eab5e3-9e91-4bfa-91fe-5770c3ca5f04", "comment": "Malware payload (Mirai)", "value": "e98282deecfcb188f990ec57f251555bb8424ffd9a492afb7432570b60dfa969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866524, "uuid": "67f53b2f-88de-4f09-b113-d9ce94e5bc8b", "comment": "Malware payload (Mirai)", "value": "0075c2b1eec07a6486b653178eb70084b7c82d01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866524, "uuid": "16948c9f-bcd1-4b59-9294-cb40c6c2f9d5", "comment": "Malware payload (Mirai)", "value": "00d31cb105992a08da58dd593efad9705b1909e4fbc635fdd5cd77e0a36968f9940aed30389310f127ad887c254378e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866524, "uuid": "d302a83b-6cc2-4ee7-87d7-b29e926a5185", "value": "T160636C0BB69340FDC196C574466F8237EE78B86913143A6F3794B6321E26F31271DBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866524, "uuid": "097023f7-d4c1-4a7d-8e45-726d5fb5ac3e", "value": "1536:SS/b0ahLzht0d3gTKzL58MrwpswFSio+Cor:SS/IYLzjCdxwpHF6+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866524, "uuid": "6039f237-c7ae-4c34-93d7-360d1a9bef9f", "value": 67424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866524, "uuid": "563ade38-a505-401f-a422-693e9f88c6bd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866524, "uuid": "d130f999-8fa9-4e83-9647-9d5c831d2825", "value": "kitty.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382c2165-888f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756880915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880915, "uuid": "e4ba6457-24e8-4158-8e1a-0422627eb486", "comment": "Malware payload", "value": "db6f7a6f35ab29153e43bd8ecd6ec8aa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880915, "uuid": "62efd325-e588-427c-b59c-99548a0087df", "comment": "Malware payload", "value": "ea229a2fd634198ad3d93dcd0fe536d0daf5420a5f0cbc6e2f58937807d3628f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880915, "uuid": "f7b593b8-27ee-40db-9ec7-cb99443a13c0", "comment": "Malware payload", "value": "f15bc9c3393efd8e0fc36adfe6988fcaaada00e1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880915, "uuid": "2f36b33b-c2e0-40b3-9b59-139ce0bef5fe", "comment": "Malware payload", "value": "12a8e407b310fbfd406be9ddc016415ccf127852b9f4766e28156064b973cafa2772ddd910c309cf19b7fdbbea0372d4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880915, "uuid": "17738424-b6f5-4090-8bf2-99486ad4d70f", "value": "T17FB34A10B7958B26E682A1351CFB82D2A731BC0A7F11570F319C732E77769A02FE6749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880915, "uuid": "b2fec520-251c-4c39-864a-82ec1a466725", "value": "768:VNhlfrk6McHREZR/CAqIDtxz99UXdZus/Uzf7VSiWr:VDlfrk6BSZIxIDt3ydl/cBS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880915, "uuid": "f76ae649-fca4-4156-ad29-bf32f4e76ec3", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880915, "uuid": "80bd78bc-28dd-4850-8ffa-b1c8af341691", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880915, "uuid": "7f9c7824-d073-4ecf-887c-16f3b54d9233", "value": "Brochure.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47084d87-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866766, "uuid": "a038a4b1-6767-4d48-acd1-86bfe098daa4", "comment": "Malware payload (Mirai)", "value": "115e5bd7a2586d4b9637a4c5bb273fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866766, "uuid": "2f8f46f1-57ea-4809-b10d-cd60cd036a57", "comment": "Malware payload (Mirai)", "value": "ea6b585ce463a75f91120cdfd5df164904c44d9b58605e12451c9bc46f66a2a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866766, "uuid": "616a2860-d930-46f4-a575-a73bd2941b99", "comment": "Malware payload (Mirai)", "value": "2bb7778adf8ed205a5e7f4e93e29c5122d3c93fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866766, "uuid": "390021e7-86b3-4613-898e-7a0fc80021db", "comment": "Malware payload (Mirai)", "value": "29cfc7a156aaf2f723d5a747bb33ff56ad0d3b0cf88cce39e5714bad2991340cd7fa208081664e1b8ace6b5edf629918", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866766, "uuid": "36ba374a-da06-420e-9f59-d5addd75cd96", "value": "T12CA2D015BF28828BC8322A7555DAF6D21293FC61F2ADDC4D2950C15BF5B33A96830F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866766, "uuid": "ef362493-58af-44fe-a7e1-aef2682ee0fe", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTu:798o08kxofBE+ZkXaEbp2F2TWul0c5Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866766, "uuid": "16d0b986-4e65-49bc-8583-c020c307671c", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866766, "uuid": "1bbf1c1a-891b-4e72-9c09-b59f6be63f57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866766, "uuid": "262d3630-5568-4b49-a4f1-066e3666a5b5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f7636b-888a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1756878889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756878889, "uuid": "eed35113-f5d8-4155-b7e8-c1f7f29edd9e", "comment": "Malware payload (Rhadamanthys)", "value": "3020cdc7a3a3fb472850bd6ff39b0ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756878889, "uuid": "7441463d-3908-4c74-a530-8992b768bdcb", "comment": "Malware payload (Rhadamanthys)", "value": "ed8690e99c1611de5dda2d6bff04645d6eceaf05e921152b3aef53e6818a3736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756878889, "uuid": "1fc89d0f-1254-4efe-ac72-2b5c11dafa8f", "comment": "Malware payload (Rhadamanthys)", "value": "367ad6ba8f9d9f7855e2ddca328222f3061e81a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756878889, "uuid": "513bd40f-88ef-4bf1-b7b3-9ab4bade57b3", "comment": "Malware payload (Rhadamanthys)", "value": "0a1b853bc045e993a232b9d64a946ea15a32db0a0a6bb4c1c7b26b5b9ec36fca084a9f8e0eb556b2d195dc1f30e08f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756878889, "uuid": "8139727a-d9ae-4085-89d8-18f10ac0093b", "value": "T1D3F6336099A2F011EEBF5F7694BB2F0A9B260026AF447DFF022960C575D779338B6434", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756878889, "uuid": "f6f5b31d-94a3-4047-8065-bf66531a4ec3", "value": "cf27a84797039604ab346a40f3a114f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756878889, "uuid": "52d48520-9d9c-4293-80e1-6fa57ebcb4c2", "value": "196608:QqXinnvF9iyMCwTDs/cJEBzMd79A1Sf1wHcRH55UnCvIzi+Lyo+gW89IgaC:QqX+SZk00Ad79AYOgZ5ILOohD9raC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756878889, "uuid": "1c249bcf-7983-4a96-b6b3-3b470b3881b6", "value": 16387452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756878889, "uuid": "bf11a515-a9ab-4093-a544-dd5985b34f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756878889, "uuid": "51ed6638-0f80-46f5-88c4-8bcb22de3bf4", "value": "ed8690e99c1611de5dda2d6bff04645d6eceaf05e921152b3aef53e6818a3736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090b0e1b-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756922926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922926, "uuid": "69444732-6908-4d68-ae60-a450ed206f3f", "comment": "Malware payload", "value": "09a55185895c85a516b4487531b3635e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922926, "uuid": "b7f58261-f36d-4e3f-9155-e9f57aa2867f", "comment": "Malware payload", "value": "ef0424546a8f3db2f9ab413a0fa30e5a2dc6e5dcb504abab97b51579a76a0c61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922926, "uuid": "b06742ae-5f5a-4997-b308-195599ef9a76", "comment": "Malware payload", "value": "28f13cccb92983fe47868bbe0ba58ff5feecf742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922926, "uuid": "15dc613d-3fe6-4d00-a8e0-aef5b2e81896", "comment": "Malware payload", "value": "41bb756274269fd21dd3e07842f39d80dd6c4eadb4d2fc9200ad219e0584f73bde2a6d0df5a4a5e3f6b1ef396faabe25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922926, "uuid": "9529dbe9-fa06-4e50-9d57-70c47f379e32", "value": "T1B9852295779408F9ECF35639C8668106C672BD630770D6DB43E04A6A1F233E1AC3EB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922926, "uuid": "66778b4d-097c-4883-8c48-f56db69de145", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922926, "uuid": "21bb5158-b35a-42c2-8766-3e0bfa6c4728", "value": "49152:/kyBb/sNpDNmLQ8A3gMMbs7AYJKVUzXP2xQiHXB:NENjmM8A0YJKVUDLgXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756922926, "uuid": "40fea936-810b-4950-8161-9c2608ddff24", "value": 1728308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756922926, "uuid": "a2857226-37c1-4074-9bfc-013c4283cb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922926, "uuid": "7b2cb272-419d-4577-8cc8-be735cdcf1fb", "value": "09a55185895c85a516b4487531b3635e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193ef3dd-888b-11f0-91c6-42010a9c0006", "comment": "Malware payload (SpyNote)", "timestamp": 1756879145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879145, "uuid": "fdc79428-1e8c-42eb-b7ac-44c2a12681bf", "comment": "Malware payload (SpyNote)", "value": "957512e937e7b6bffaff68d2a9d761e0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879145, "uuid": "5f766d90-a909-4dd0-b6ea-b75b15c65ec3", "comment": "Malware payload (SpyNote)", "value": "ef2001f670cc5a338be175847dfbeb2bccb52629d890b39c866dc8e1ea1f0620", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879145, "uuid": "467baef7-3983-478c-96d2-f7e47fb9b53d", "comment": "Malware payload (SpyNote)", "value": "dff6fe6e408d9f5bbb045e18d2916cdbe2ab0923", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756879145, "uuid": "5cb3508c-f923-4271-ae08-4af5992edbd3", "comment": "Malware payload (SpyNote)", "value": "38dc034418dfa95f4d3e94f5a02e6460e3583019ba49ea17be168e89e2ad74a02561fc2af8b467a82e6cdb7a9b2b3d88", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879145, "uuid": "0e83dd0a-2868-4cb5-ba50-679fd51357a9", "value": "T1B93633419602A983F55F31F3C1259F30C6763D1E2DD27BC63192B92C5ABF7368B628A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879145, "uuid": "839a807c-4df4-4eac-81a3-40ea085e85c7", "value": "98304:PjEN9BIwNElXNe8KGjURMMjfsAD1JuKUN+toafunS+ng8jNQzUY:rEKpIjfZ5JQIe86Xng8SUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756879145, "uuid": "70147527-4971-4191-9bd7-750ebf5cb5bd", "value": 4939443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756879145, "uuid": "3d464f98-9a11-404f-89dd-d1613c2d5c6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756879145, "uuid": "e88f78da-dc37-4dcb-bc48-5c50c293169d", "value": "PagBeneficios.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40b14a2-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894061, "uuid": "376e0281-f006-425e-b392-f11bbe4e8ba1", "comment": "Malware payload (Mirai)", "value": "67939282c5ff3f018ccc17e17116c977", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894061, "uuid": "bc2a3ab6-0be0-4852-80a3-b8e375f7a232", "comment": "Malware payload (Mirai)", "value": "f0178160c0756d2394cf660a8b76c4481b4226544e812a5ad393461105d2e8e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894061, "uuid": "14102cfd-1331-4dff-b421-db31f271d9a0", "comment": "Malware payload (Mirai)", "value": "e47031f8bee34dc16281c413f4c43838bea1329f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894061, "uuid": "24f8b0b3-e903-4df7-a7ad-3e3daa11a276", "comment": "Malware payload (Mirai)", "value": "3338afe2cff851bb815c583f8710fcf2b83e18a34f2d9e773d19777c526135d63c69ce9234d8e791f6bfff84abba0a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894061, "uuid": "ad9c8fd5-1e12-4dfa-8811-a0d83623565d", "value": "T1106328827880AA26CBC0577BFA5F108E331457D8E1DAB3479C191FA076CAD1F0D6B75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894061, "uuid": "30023264-9777-403a-a4ba-a2cdbc941235", "value": "1536:dRqCA7shu+z506mEu82prPw+70w4Y8jkMhW65g8Yn:dRqG0pjp70zY8jLr5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894061, "uuid": "c3a6d54f-eac7-41da-ad51-a16589180151", "value": 69452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894061, "uuid": "dad149bf-7cd0-4097-973a-048023ac53c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894061, "uuid": "87342e28-03bf-4e62-9ac8-7690475ba625", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3058734c-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1756891639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891639, "uuid": "43bbd9f7-7da3-45ca-bc17-08d630324fc8", "comment": "Malware payload (SnakeKeylogger)", "value": "c421f597a1f1bd55b07d842047d86719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891639, "uuid": "0d040671-fbf6-4cc4-ac3c-93efaa811ef8", "comment": "Malware payload (SnakeKeylogger)", "value": "f0511e0567f253276f92a19579e7f0e133a28e6ccc5f2b626a623b5e80073b81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891639, "uuid": "890403ec-7738-4fe4-bf04-a2eac8fd0d5f", "comment": "Malware payload (SnakeKeylogger)", "value": "c7d51eaf221b6d75f885c0359d6f58900b43d339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891639, "uuid": "46b00fd6-f0ba-4e5e-861c-4f0fca381276", "comment": "Malware payload (SnakeKeylogger)", "value": "d163cc0de116f8898b0ddba4c7bc92e7f81e5279cb663bd76bfa75685acb7507fe4f4e753431ae191c524421a58a56e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891639, "uuid": "0985a08b-207a-4f3c-9d28-e1305ff2daf4", "value": "T153E412942706C817E4B223F45CA4D379677E6EAAEC12D3064BF8ACDB79327046D90793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891639, "uuid": "041e7a82-a10a-444f-9a9f-ae41ccea0692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891639, "uuid": "d5caaa31-5856-4c05-9cc7-eaa69b9eb76d", "value": "12288:Q3s0OWIAqCm/CxaQ1Hror9ZH49JZdvsnW/gG5afupLnoCkg9lrMKnksG+:QyQoZH49JZFUuacggXrMGks1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891639, "uuid": "3539e30d-7064-482e-9757-08b0211e4466", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891639, "uuid": "6532208f-0f40-4b39-9d0a-6ab00d01e67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891639, "uuid": "438da9dd-74ea-4885-ad2c-057cf155e5a0", "value": "F\u0130YAT TEKL\u0130F\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5656377-88ad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756894063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894063, "uuid": "9061300d-4a09-4ac7-980b-9b0a2756bb44", "comment": "Malware payload (Mirai)", "value": "c17ce72180b522bdbfde89b1ee95fd30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894063, "uuid": "64ecc016-b94d-4436-9e2e-1fc24b75a2ae", "comment": "Malware payload (Mirai)", "value": "f06f1acc70c897d4f05ca10c53cff3fa13357ea17609c9ad359b3aaf0672d5d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894063, "uuid": "3fe5d86b-714f-4d3b-9fd2-227da2beacfe", "comment": "Malware payload (Mirai)", "value": "cc7df10ed4e6b75c7d8bade3ea0038638752a988", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894063, "uuid": "7a5a8351-1702-45bd-9450-300cd17177a1", "comment": "Malware payload (Mirai)", "value": "4534b63d5ceb9938d325311b152b81ee6197e68415594d76280cf77a15f8f114f941d290561ec1fc65e45ffe3feb4472", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894063, "uuid": "e90c750c-c04b-47bc-86e8-95f6b5e54c39", "value": "T1E6732985B8809F14C6C5177BFA2F108E330297ACE2DEB3539D145B6477CAD2B0E36A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894063, "uuid": "3212901a-4936-44c0-a470-f5dbac04cbab", "value": "1536:NkniCvLhqvSs6w2SiEyEtRCqq/BsoLmpMguHcUNVUHalw7WuuH0hsfC2ermQ4Wmr:+LhkSfwXXTCqjoLmpMguHcUNVUHalw7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894063, "uuid": "711f4e03-defc-4c06-bd7a-d6d94c66211c", "value": 79896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894063, "uuid": "65ae004b-639d-4e35-a90f-76af2152adb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894063, "uuid": "05881f48-77b1-4070-a610-19009bd635eb", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd98fa2-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1756891900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891900, "uuid": "069ee01e-34bb-4c00-b83f-d1abc9e877be", "comment": "Malware payload (VIPKeylogger)", "value": "3258cbfbe7ffb4c6984aae9bd3ff631f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891900, "uuid": "1baf7ef6-7d98-469d-9278-3a295677e75d", "comment": "Malware payload (VIPKeylogger)", "value": "f10c3f6d8400f5ded7232f4af6de612ac7dbc9d593a7f73b957d4a08585e30fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891900, "uuid": "26b06ae9-e09d-4dd4-82eb-7e62f3e5f460", "comment": "Malware payload (VIPKeylogger)", "value": "312abf3da669d479c81ab141c7b7926cab1059dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891900, "uuid": "c52159b8-a896-4aab-8b6a-735139d701c9", "comment": "Malware payload (VIPKeylogger)", "value": "b6e8449b0b75c050559c426be5815f5864eadd3eebf0a238fdeab2eeb59ad6760acb8138cdb15d31a93bf74d249b8b9f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891900, "uuid": "0deca510-6752-4bd4-8135-8181c9768bfa", "value": "T11D34CE656EC410FC6436E16D2B838FBBDA605B1F187E613639BE60005F358A096DFED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891900, "uuid": "12811322-346a-4489-a64b-6e845e047f52", "value": "384:MXLbDTcHc2efzfTfOApqYfy3MIpfsnpfI1a+efKfMApqYfyrfHhktfffXfof2fqI:aLvTcHcO49KRL4zH3MstnSI+cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891900, "uuid": "4541de13-c25f-4755-87e8-facbe16ed48f", "value": 245532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891900, "uuid": "99e4fdfa-b84f-474d-aca6-bb93a04faae5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891900, "uuid": "a51a73db-7492-415b-a8eb-3c2e1d89ff07", "value": "NewOrder14397601092025.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832e63d6-887c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756872880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872880, "uuid": "46cbdcf3-234c-4190-bb90-13598e849884", "comment": "Malware payload (Mirai)", "value": "22b18e245a6613dfc35c0bbcfda407bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872880, "uuid": "2a118d13-9357-4847-8847-fe17d48f8475", "comment": "Malware payload (Mirai)", "value": "f32d3a95ab45b136af0d5e57a417d0b5b3652abf9d659f7c489cedfa7b015727", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872880, "uuid": "c3bfc201-80ba-45b4-a9c8-3447ac2079bf", "comment": "Malware payload (Mirai)", "value": "1e8c2fbe151167c2ddedad4bb852e3c7e5393842", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756872880, "uuid": "4606ed78-3061-4edf-8fa4-53a8274c5899", "comment": "Malware payload (Mirai)", "value": "81d129fdcbc6124ab53a65b3f451a86065ab01e146826b7e0a233613b4efcaef9b81c69906d716bbfca89c729bdf2b67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872880, "uuid": "93d729df-3a91-4483-9a0b-8025c6bec4cf", "value": "T165F08CE605C10EB574C4DACEB2AB8EBD4009C5CA2CCB06C48A8E41B8F708894F462E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872880, "uuid": "b1d7123a-d7f3-4c16-9efb-46a4b182690d", "value": "12:8pd/2eg3Qrid/2S0btQ5pd/2eyQ5id/2HbtQO:8d/2eFed/2Jbind/2eDod/2HbiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756872880, "uuid": "859163ba-88c6-4920-90c3-8746220253c5", "value": 624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756872880, "uuid": "f22306b3-2c45-40fc-a749-424b3baf5710", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756872880, "uuid": "fd3c3e5c-59bd-40fc-8d94-d426b0bd25cc", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c5bbb2-8871-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756867967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867967, "uuid": "de0b849e-3697-4c47-83ec-24995ad86c94", "comment": "Malware payload (Mirai)", "value": "79f3b98cda65ed2abaff7fc039a5010c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867967, "uuid": "bd4f640e-dfa9-485b-a84c-f66f3c0175b2", "comment": "Malware payload (Mirai)", "value": "f38db67a038dec44df5b6d3e4a36b81f05574f7105da26bd75d64bd701ae1399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867967, "uuid": "8c853e0b-aa4e-4cbb-b60e-1ae447b383cf", "comment": "Malware payload (Mirai)", "value": "97bb1019db957178c8fc3e07543e68fb3eec0be7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756867967, "uuid": "2b934a1c-e7b0-42bd-af41-60380c6f89f1", "comment": "Malware payload (Mirai)", "value": "79a137214a11ee83f88445252c61a9120fbaf0fa0470e831d5c544243a0ce136e8b08b858daf8b83a839623335a4f10b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867967, "uuid": "a96869c9-a2e0-4ab1-8d60-30f6fd00fa5f", "value": "T1FE247CA8BA0F6C41F1C3D3F8DE8C87E13A1B35E3C7768971791212EDCAA39D95990512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867967, "uuid": "db37c821-e6ac-473e-9251-75a5787567d1", "value": "3072:Xy9CpEBpXouNWBO7v97cyts3b07aBBuxd9MlMJJwboq:86EBpYuNWBO7V7M3Y7anOMlEwboq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756867967, "uuid": "cc24c4c9-cc88-481d-aeda-d4ae5966edc3", "value": 215032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756867967, "uuid": "51b1d06c-be69-4b51-8583-875baca76bff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756867967, "uuid": "bad330d9-e1f6-4272-ac96-cf3f8218c293", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee2ae21-88a4-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1756890133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890133, "uuid": "7cbe302b-fab9-45fb-98ef-08eb4d3693c3", "comment": "Malware payload (QuasarRAT)", "value": "01cf7d7e2e057c95e861a95cbfec6221", "object_relation": "md5", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890133, "uuid": "d7fe1620-bc39-4032-901f-668c029145b4", "comment": "Malware payload (QuasarRAT)", "value": "f3e081a4b2e4302d3b14e5f16aca269ea93aa5cb816bb7ac2a8e4f51a80f0fde", "object_relation": "sha256", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890133, "uuid": "a2ec9153-49df-4540-8c27-253894812384", "comment": "Malware payload (QuasarRAT)", "value": "c14ad7985e4720a3ba050e93a10103385c5c8d70", "object_relation": "sha1", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756890133, "uuid": "d0d59a8a-892a-4b9f-aefe-e9ee452e890d", "comment": "Malware payload (QuasarRAT)", "value": "b325553685e87363141d5456a4bee183e39ab90a8a0e5106535294d372fdcfabc03217d823620b8c30d0c003547f0f68", "object_relation": "sha3-384", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890133, "uuid": "76923700-9784-440a-bc45-b8105ed5617d", "value": "T1ABA52326B3A510FAE9B3C57D8D934544EB72BC528361DACB03500AA72F277E09E3D752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890133, "uuid": "a76ecd95-e01b-4eb5-8be8-ba08ceeab136", "value": "81bd0a759bb35e35112306c97d63e830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890133, "uuid": "d5d6697b-6b97-4361-af93-aae300499b55", "value": "24576:U9yEo0uwHZNKoTYhINlW7ZQT1qV+ghdk0fWtDpute41VteA5nJGSbYSLJDy:8oP+NKIYNGShCDpyeAXe8nzYS1Dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756890133, "uuid": "57fc3732-b80e-4219-8e12-f1bd8850a548", "value": 2149888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756890133, "uuid": "566b4671-1db3-473b-aaf3-e3d208b95381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756890133, "uuid": "dc61d4a1-492d-4fb6-bca1-8140ccab3abd", "value": "175687974566d634c9e34842f77093b78cebc8d3b2a82702c3c13651dc1fe8e1e45d43aa67939.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a467a0-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866767, "uuid": "23155fa4-0708-4c7a-a0d5-b52d09fc65c1", "comment": "Malware payload (Mirai)", "value": "e7e5d17589cae5f25e33820213a74a4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866767, "uuid": "a2e4a034-7b86-4786-a0ec-ceb0967125b7", "comment": "Malware payload (Mirai)", "value": "f4b3e2ba51fd8675b88fd97020fe8a47f0ec8e8974ecd8ed5b39bb2b07a7b0b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866767, "uuid": "4d2f03ab-6ad5-484f-8568-ea0962b42ec2", "comment": "Malware payload (Mirai)", "value": "909b01240f4fdfd420a159db98b43b0a17333875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866767, "uuid": "8c1a5f29-1b02-4229-a6ff-24f804e144d8", "comment": "Malware payload (Mirai)", "value": "ede4430751daf4dcffc9c89354160f2cdddd22eb5d19222293c2925bdb3a677363f6c4c5c8153fac238f00f5b6545ff6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866767, "uuid": "f83f3b5b-51b9-4c66-8420-98eb1473ddcb", "value": "T14DB2DF3C2B111BA9EE1EC0BD839C0B213CB41B2591829D5B6207FDD79F968B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866767, "uuid": "d06a4ce9-c0e5-47c7-a9f2-3f8f4b527119", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiUGmdtJgGlzDpH7uNj1JAG:YeD8ZSWvZHZbs1row697qohQvg9VitJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866767, "uuid": "7fe3c14e-055f-41ae-84b9-98aa2c9349c4", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866767, "uuid": "1fc75508-7dfb-4705-a2fd-4e308cd47835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866767, "uuid": "09010c9e-fa40-4d15-88d1-3d6c9695999e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09febfc-886b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756865682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865682, "uuid": "3f2ed51c-3e30-42e1-b516-daa8d399ba17", "comment": "Malware payload (Mirai)", "value": "91c998d89f6e2c1f0fba5c5f9c027a13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865682, "uuid": "8d76b9c3-9866-429d-91a1-9974ddc57ae2", "comment": "Malware payload (Mirai)", "value": "f4d78d33730b1d753d126b0a7e0b27d249408a7ffa04123f755c762d026f5050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865682, "uuid": "c4d9ec4e-d713-4ce7-9a8a-e8c2cd047980", "comment": "Malware payload (Mirai)", "value": "1f12503befa4ad44500e2f82428cf77ce196dd48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756865682, "uuid": "1172aa1a-9685-4552-af31-531c362ed85d", "comment": "Malware payload (Mirai)", "value": "6c687604b60c18768e7d209038d31091087efe12eaf0c75dcfefa499ac91768016be6a4caf4eac7e4fc285e6fecf1f31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865682, "uuid": "c8a0c827-acff-4294-a10a-82dc8e68f472", "value": "T14DF275453A229FEDF36C823947B78A20A75823D527F0D684D25DD9041FB034D699FBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865682, "uuid": "f9751ad9-20d0-4dc0-960d-15d2a3e5dfa3", "value": "768:04tnKW3/V2UwS+chRZsa3hgg5QICPCni/GsjW:RKmV9wS+ch/Bx3fsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756865682, "uuid": "63d28d2a-578d-4f0f-9a67-f566b194d2e1", "value": 34580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756865682, "uuid": "0db6b3ed-cc4b-49fc-84da-aa19190e3d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756865682, "uuid": "6bb39398-bd34-4a7e-8743-c1d65d9d3f04", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1d16c1-886e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756866825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866825, "uuid": "8e7ef5a1-71fd-4474-b879-949cc69b7048", "comment": "Malware payload (Mirai)", "value": "0106928ed7fefaccd627ac166ba1444c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866825, "uuid": "3170f865-7e07-4986-ba9e-7c94a13645a3", "comment": "Malware payload (Mirai)", "value": "f4f516a6dd7d07c144ff25cb859e7ce45e5d45e3ad957d99d961a97ed4d351b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866825, "uuid": "bad4aa6e-32dc-4622-8013-756e8b106a29", "comment": "Malware payload (Mirai)", "value": "6f6c90570c3745e312aad4c6e1260613a65df4ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756866825, "uuid": "08868996-8fcf-45a7-b8e2-fc0abe4c6e36", "comment": "Malware payload (Mirai)", "value": "7427b3a4e941f9bf247526922c3d5332caed4d05db21f971f55404e85873769c05cf02af30e687a3f5c762dffa670dea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866825, "uuid": "b16e9b58-1ee2-4d52-93a1-7d82f0ec455d", "value": "T1E663951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866825, "uuid": "ee7f7d9f-d57b-4ed0-a2d5-916a790261f5", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAp:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXziL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756866825, "uuid": "2d66f9e1-6303-4755-ba11-1e3ef6c68db6", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756866825, "uuid": "7525574d-0245-4809-8b33-ad75eca00006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756866825, "uuid": "aefb7569-b8e2-4c11-a743-99b248a0daa0", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdca1e8-88f1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756922986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922986, "uuid": "8ee9e30f-b7dc-4b5c-bfb1-451cb955e5fe", "comment": "Malware payload", "value": "6cc41b664d6e26a94f0a9ccec5f3ff95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922986, "uuid": "c3807a0c-4fdd-47cf-aed0-93c083de562f", "comment": "Malware payload", "value": "f5dfaa1c77a27acee74539e17512a277d0e05358bf9ccce7f59c76bd7fd5551a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922986, "uuid": "57dc3f8f-da17-4052-ab11-bfb2a26ff344", "comment": "Malware payload", "value": "1e2cfd520544e0ec273659636cedc9ac66c48f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922986, "uuid": "a58c091e-1dbf-4b1e-a973-64b576c04708", "comment": "Malware payload", "value": "0e06ab715777318358ab818a7bdc9c5c335d808656c3c85ea08734a8bd9c58e0ccad0666f8f9e39725367edac2a8ffc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922986, "uuid": "d9f25f99-1aed-4c2a-8ef4-688e806337fe", "value": "T1ED254C5B73A420F9E1B78279C9921A05F7B678760B509BDF03A047762F232D09D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922986, "uuid": "d84569d6-c8fd-4024-a821-ee2eab3e6510", "value": "9b6f0da37c6c7d9c966b7d700036185c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922986, "uuid": "9c2b50a0-942c-48a5-aa66-ccfc0bf0978d", "value": "3072:hCElvxXChAkc863Hlqlezb4UTUgi01l2hkwgpjS8Hjf:hCM1C6kc86X4le4UIgi0zLjhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756922986, "uuid": "07a08211-7a2e-424b-82aa-60e5e7f3c81d", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756922986, "uuid": "f21e2a7f-c301-4e28-9314-657815110a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922986, "uuid": "1a770ff6-a11c-4df2-8164-957aee6fd16e", "value": "6cc41b664d6e26a94f0a9ccec5f3ff95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3201cb48-88af-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756894648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894648, "uuid": "08edbd3a-2910-4e46-9aee-7c570d6b773e", "comment": "Malware payload", "value": "9b5c886328cb70dc8bca17401eecf457", "object_relation": "md5", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894648, "uuid": "254997fb-3216-4665-a3e7-dbd3ea1dcbbf", "comment": "Malware payload", "value": "f6134949d6ce903049314fe5f0d46973be13d8e11203c22cfce0af39089fb5cf", "object_relation": "sha256", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894648, "uuid": "ca5763a9-2caa-4786-b188-9a16626a35ff", "comment": "Malware payload", "value": "62dc1a6321f642578c61bbfdbb9037a156b3550f", "object_relation": "sha1", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894648, "uuid": "8845146b-0607-4caa-a2e2-e01909d6e2e6", "comment": "Malware payload", "value": "88fd5dd6e99da0ba5d73d8976927395d658b197f94e96c2f505e5d22407ec0e7905d4f3a6f5e1a191edc5f3905aa5978", "object_relation": "sha3-384", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894648, "uuid": "8e80eb87-9193-49dd-888a-5be958dd7aa2", "value": "T1C56633A43309E953EEC215B6687465D794089DAB5CDDFB3B8B333AB0647D6FCA60C810", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894648, "uuid": "fc970033-e3b0-41ca-b597-e54e80910de1", "value": "196608:1vCGLlfijMBTRDGiDRPL1Zo5NMsDUruHSpFuwCJE:5fZB9DtZyHbwzFuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894648, "uuid": "709285ce-459b-4549-8fbb-f592a5637ac9", "value": 6742700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894648, "uuid": "d38b8a79-2f42-474a-9256-02092f61c70a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894648, "uuid": "e8ff2ec8-d86b-4c54-a6e1-831203fdfea1", "value": "dropped.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdfd650-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756930179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930179, "uuid": "35efface-10df-4b97-a939-9b9abca1ef3f", "comment": "Malware payload (Mirai)", "value": "c2942cfe2c10b3cacee6b434ac5bbdb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930179, "uuid": "3f479795-5253-44c4-83b8-a3a75ecb172f", "comment": "Malware payload (Mirai)", "value": "f613d5b40fc3ec33584e3342efe750c55f4cf4113a9b903c26f5f473855acbc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930179, "uuid": "e170f9bb-2b53-4249-b62d-bb0d2e695b56", "comment": "Malware payload (Mirai)", "value": "a139a6cc873e949f073da5ac51b1e1315d7df8c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756930179, "uuid": "8180873d-7435-408b-b042-06d2488a740a", "comment": "Malware payload (Mirai)", "value": "03367566fb48e7382a97e3a055c601567ef5cfc5bdb0d4c12ca57387e09bb786024012a1096064eda69da24b6619563d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930179, "uuid": "4a904e3d-b37f-45fe-9363-3e777b41a3ab", "value": "T1B373940ABF610FF7E8AFCC3789E91B45248D641A21993B797D34D818B24B64F49E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930179, "uuid": "74aa4cdf-4661-4912-9ef8-a6ed5d772cf3", "value": "1536:QGFfut1avzBpR5Ygxmk+ORZsTefCqNuRHxa:fFfut1aLBugxm18uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756930179, "uuid": "9226a57f-de8f-4f29-adcf-0cf7bdb9b5a0", "value": 79900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756930179, "uuid": "76b1f434-9d8f-4be5-ae38-bb74c72fb627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756930179, "uuid": "006f01ce-13f6-4cfd-a3b0-887a70d31ff1", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bccfea-885e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756859860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859860, "uuid": "685bd60a-27b8-4f7f-b8ed-4c245bb99fc3", "comment": "Malware payload (Mirai)", "value": "73af95bc91a5abf309d222190eebe883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859860, "uuid": "4ccc9fbb-681a-4211-9ff9-ae14321781af", "comment": "Malware payload (Mirai)", "value": "f662d7466303ccebaf57df91e89088efb871d772c81047a407948269f5195df4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859860, "uuid": "e3f46bbd-aa89-4351-af41-f113912c5a9b", "comment": "Malware payload (Mirai)", "value": "66480a550a74df16cd776ddc2686a92bf9f35689", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756859860, "uuid": "56dd77fa-3d95-4f77-b7ce-184f78c3edce", "comment": "Malware payload (Mirai)", "value": "c942b7a304e3aef2a8206d58d3258bd9355f870d62e046960b5179ce52ee337ff44f2492eb50997a87b51261268801d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859860, "uuid": "f7d7b98c-0011-4206-a3ad-9ec9cde723d1", "value": "T1CB738F68FE0EAD82E2C7E37EAD564FA1312738E8D765C2723901935CD0D9ED4C991227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859860, "uuid": "d42e92ce-4d87-4f0a-96cc-c2d117642e49", "value": "1536:yOeQYCv+NjjOMmR+WDGd74VikeQBhIkTkmko8oKauN2Ir1:yNQFv+0MmOVOlnr4mkPoKV31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756859860, "uuid": "82ce115e-67f1-4899-a0c1-dfface7cd70a", "value": 79480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756859860, "uuid": "890020e7-4c5a-41d9-93a5-da400a74d654", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756859860, "uuid": "9b0b622c-2605-4e76-ad62-96ce27c75860", "value": "kitty.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f472ba4-88ba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756899422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899422, "uuid": "e4583b8e-7114-4783-9cb3-e68f1fe562b5", "comment": "Malware payload", "value": "1724fb46f836a89513b937499d7f3d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899422, "uuid": "1b90c012-fa40-4372-b7b2-d12304321f52", "comment": "Malware payload", "value": "f6a4639763de8eb928bb850e8693e42d91ded59552ac578092fe8f2bc98fbeef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899422, "uuid": "43f9beaa-0c1e-43eb-ae45-15212fa92c0e", "comment": "Malware payload", "value": "bbfc95a5e0c2f7a2554283d3f3dcbeafdba0b104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756899422, "uuid": "866b5b3b-50db-4924-8929-115a8f4cc012", "comment": "Malware payload", "value": "9b2e512f22cd9cff5e341d204a72fe68cfdffaeccbdd7619bdccb015295a4db37e25e859eea00a37133fc2d73dc877ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899422, "uuid": "43557023-61ec-4539-9c15-ecd02cfbfb8d", "value": "T174858E02D9C35CF4DC4F2E301A67F77ED63887594920AE87A308E8DCAA12DF28575769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899422, "uuid": "019cf1c2-00a1-4e84-9a87-775f30ecaa8a", "value": "4c2d1ce4b338ea8d18addf8a77ab5b36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899422, "uuid": "4eeb1863-471f-4799-82ac-93f6387aa728", "value": "24576:ctl25/phgIFUJDND1nb8rGEQHtASNRMS0wgAjIpr/5dtPvIFPx:ctA5/InN51P0TN/9CJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756899422, "uuid": "862db25d-85a4-48f4-a328-be5202073fc3", "value": 1753088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756899422, "uuid": "7a39f1c9-9386-4939-b02b-caa8fb594c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756899422, "uuid": "428f7a00-1a84-458b-9547-5c51dae783c4", "value": "f6a4639763de8eb928bb850e8693e42d91ded59552ac578092fe8f2bc98fbeef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f708151b-888e-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1756880805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880805, "uuid": "03d1a37b-b47f-47a1-9add-9164e7796908", "comment": "Malware payload (LummaStealer)", "value": "73a6813e34505dccbb5f81e2828c8584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880805, "uuid": "ada68c52-137d-47a0-b15f-58354b130c02", "comment": "Malware payload (LummaStealer)", "value": "f6bcb9c86a45cccbfb318545d3e3688d0c37e74892dadcac6e40970bb8b83ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880805, "uuid": "b6c77b77-2ba7-47a5-a39f-c4f90b3a9309", "comment": "Malware payload (LummaStealer)", "value": "8162901ac594a15c72ccd073dfd258041753b1ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756880805, "uuid": "bed482b5-2e20-45bb-ab29-0a2fed9311ec", "comment": "Malware payload (LummaStealer)", "value": "46110d640216f9d0ab6368858b5209efa71ce82f333fb26a0c1ddd9a223fa2557279e6d7ae2223804d104e98808371d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880805, "uuid": "ff296eec-e991-476f-b3b0-4fbd0a26aa49", "value": "T1D155D018E87590DAFCD340B06F769112E433BD7B8F385A9B41E4DB612616DEC0A3A376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880805, "uuid": "df4778e3-249b-47df-aff7-5e808ce759c8", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880805, "uuid": "7c92076a-7fa4-4ea4-9f18-8baacf532724", "value": "24576:RSaYxjk4UGMFAT3LZrzuGPxvziFgbrkQv+K:RSZxbZf7ziirki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756880805, "uuid": "db893d90-2451-4504-9eaa-01fbd8374d64", "value": 1302016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756880805, "uuid": "32b83251-ada7-46a9-a080-28631c01207e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756880805, "uuid": "93a771e8-d8ce-45c0-8f69-ad3c8fc15b68", "value": "73a6813e34505dccbb5f81e2828c8584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b1092f-8883-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756876020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876020, "uuid": "b1bf45d0-d5db-4301-b095-7bcf50d16c69", "comment": "Malware payload", "value": "8a12fe112a5229844674768b11e73979", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876020, "uuid": "22e03794-d0d9-472e-ba15-7fbf62cb1436", "comment": "Malware payload", "value": "f84926c25de1851b59d833b74f6f489c07565335bbb241563577426a374887f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876020, "uuid": "4da79175-6e7b-4568-9b00-13b37eec1112", "comment": "Malware payload", "value": "3e3f117fb25f5fde50b236da4692c93679e851a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756876020, "uuid": "d267b003-3cbd-4ecb-b711-e5ad552d8d46", "comment": "Malware payload", "value": "12485512f24617758a038571ef72571354ecfc4792a0f92db53d50748602e80c38efaa65dfafb39b46b352e7d8e38267", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876020, "uuid": "457140d3-9789-46e6-9d10-9c2aa5d89ad9", "value": "T123519B8D12202B9A0F00EE9DB5A54C54804C73917CA776CAFA6D5E7FBA14886716FD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876020, "uuid": "2e18155e-715f-483e-b05b-7d241d3c7e08", "value": "24:S/0LJgLRgZWpVUHUM9npUSx8lWlGkHL5Klv5pSOMzU3JhAIHlIoUJ:SMdgL+7B9npcQtHL6rMjIHDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756876020, "uuid": "a3d4f183-f392-4768-9cae-338a433472f3", "value": 2984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756876020, "uuid": "825cd572-3064-49af-ba20-608ae443a076", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756876020, "uuid": "ddd47923-8170-4907-896b-e82577cf7687", "value": "download-47_new.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f69bca-887e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756873858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873858, "uuid": "c65e0450-0060-409c-b13e-1f01a7d327df", "comment": "Malware payload", "value": "a2908dec735dfc9a4ae89427218ec43c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873858, "uuid": "6e4c5d2d-d6ab-4555-b863-59c3d58efc80", "comment": "Malware payload", "value": "f856336662f462c18822a3595d3efee05d4a03eddc8ba13aadc2d83cad656a53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873858, "uuid": "71588c19-6613-4877-934f-2ed8ef5ee582", "comment": "Malware payload", "value": "0e422eba6195fc92459742bd7386270077f60585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756873858, "uuid": "39da5ed0-f84f-4903-8118-679496954672", "comment": "Malware payload", "value": "0f8db40b3fae50f28582d98e0268d3cdb50325aeb2be3a7543f3978d05cc1760d357429fa67d07a7ad0f61ea52f642d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873858, "uuid": "c9aefda2-35d1-4e52-8e3c-d3f6919b727c", "value": "T1A245D0189C7590DAFCD340706F76A112E533BD3BCF242AEB51E497512A16EEC0E3A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873858, "uuid": "3e679eed-eef1-440d-9ca9-fad0cb55446a", "value": "37801b95c438a73e300d9190a7cb0752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873858, "uuid": "6197d832-a87a-4244-ac6d-414c6b6e4b36", "value": "24576:qUYxEL+Rbj/0c9qx6rFdmJYPD7yasQIOzNx:qUAE69t9qsFpJUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756873858, "uuid": "810f4068-d33f-42e5-80df-92988647bcd5", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756873858, "uuid": "e77eeec1-3733-4703-baf8-bbc5e235936f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756873858, "uuid": "72cf5e58-0b97-4e0b-99cd-679098954dac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638f0395-88ab-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1756893013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893013, "uuid": "29159d92-fe4c-4442-9650-875a2fdb32f0", "comment": "Malware payload (njrat)", "value": "9003f47b3f40a0f18e565e438c55308a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893013, "uuid": "0379b524-cc56-4c30-9356-201b4768a2fe", "comment": "Malware payload (njrat)", "value": "f9df0e50ffcebcef8aaaa4d7f4b87091b78cd893a46913115b9289501c059541", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893013, "uuid": "1b5b3ea8-aeb6-491c-8a31-0c82259bea9d", "comment": "Malware payload (njrat)", "value": "62ff5acfb6ca367a6e426b765b15068e4c6c31aa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756893013, "uuid": "242ae475-5a29-418f-a520-37c78a15f746", "comment": "Malware payload (njrat)", "value": "0d0662e057d13ca9d00895f3da8a35932ebcab449f1eb8b2c08d50733f7aa71432041ac56217183e4931cae7c09fede2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893013, "uuid": "cd4d5b83-f929-456c-8cf3-d870d8e59f67", "value": "T1D4536C07CF9F3E76FFA0020132EE98E52A5D275A02F08DAB3D4A8DD90E8646419D59F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893013, "uuid": "9f08b83c-8cd6-4a87-bd3e-935641fb5eda", "value": "1536:/5ZcZzeefLI0FKT8sySBoWJw+N4i3JtK+SIt+hdKqV0jxOapnjkdOoynO7ke:/5Zc1bFh/i9pIQogKke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756893013, "uuid": "2e554070-8d96-4e1c-a569-fdee2e9b7074", "value": 64382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756893013, "uuid": "1952ad8b-4761-4322-85a7-59d4556a339d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756893013, "uuid": "fcc1db1c-f1ad-47ee-8c49-6113e5ec4cb8", "value": "L5PRICE QUOTEE.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abff42a6-88a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1756891846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891846, "uuid": "967964fa-519f-44fd-8c1c-c66c67e9c225", "comment": "Malware payload (GuLoader)", "value": "152e92eabc8560f1ac37578552c92db6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891846, "uuid": "a3934d48-ef1c-4326-bbd2-3accad536684", "comment": "Malware payload (GuLoader)", "value": "fb0474ff5b6eb9092eeecc6dcb831dd538a72878e39afbfd7d088d0532d03ba2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891846, "uuid": "3219d2e7-2b86-483f-b6f1-f11167109f55", "comment": "Malware payload (GuLoader)", "value": "d12b51e24093a9e784e463a65c568309e6075f7a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756891846, "uuid": "8a28936d-c256-49d4-90ae-bd5994a3d878", "comment": "Malware payload (GuLoader)", "value": "af194975cee3d0840c8bb034b6d05a947b76a4af8352130044b6e2b141bbe0cba571126407e723816598a4ead27448e9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891846, "uuid": "3cc99828-7cc3-418d-a433-e40dc633347e", "value": "T12DF26E60DA0249750E86BBA8BD4907F0C8ED8215556780F1F59FD72C9209AECFB7C1AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891846, "uuid": "11ffd44b-c74d-443c-bd95-6bb2bc3f26a5", "value": "768:t4XhUiE2jfOLg5UWD27JuHDX2PnYHQXpb7HLx1QSZNm13:t4XbBqg5byy+YcxrxBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756891846, "uuid": "a4e6e625-9710-4824-bca7-4064ea5105fb", "value": 35443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756891846, "uuid": "708910fe-0570-4509-b71a-d457d4457a18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756891846, "uuid": "f6f64b44-9ba9-414c-b355-5125731abb72", "value": "2025-09-03-0803.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a039e075-88da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756913302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913302, "uuid": "e51cd6af-2045-45d4-bdae-1ee24dadea21", "comment": "Malware payload (Mirai)", "value": "8d34aa9ac93350d680767bcdd14222c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913302, "uuid": "ca182235-5c33-4848-9c59-32121abc883d", "comment": "Malware payload (Mirai)", "value": "fc9035c94f225e93a6a547d4d972d7eb6aec3628ec82d7538fdc33633d557491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913302, "uuid": "7ab8235d-ce7e-4c7a-9d50-9c4d405aea28", "comment": "Malware payload (Mirai)", "value": "60cae7662b19483881824a5afd4f71c755b01150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756913302, "uuid": "d0a02a56-9ca8-495f-83f1-4dc98e48ddd3", "comment": "Malware payload (Mirai)", "value": "45c9c22d1ed8ae84c1d6b5e56b9ce3bf53c893b2b1acd3d25381aa7bb66b59845ae0449b050fb304025388a79d6493d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913302, "uuid": "b09cfa49-de1e-4b85-ab0a-b471b1e52c83", "value": "T1AEC2D1957424BDE2C9306C76DE6888C63786257C50FFB87755110828AED58CB5BF8187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913302, "uuid": "47cec385-b8aa-43b9-86ae-ed32e8e3dc0a", "value": "768:cMKyhegCCMqfN11zqcEobtfUxYaOLz9q3UEL3A:TKy4qf7ISParLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756913302, "uuid": "2d7c923b-45cc-4671-bd1c-3b10f0fb7553", "value": 27292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756913302, "uuid": "5fa0f83e-cd0d-4094-819e-389067bdb95a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756913302, "uuid": "f1bb3768-bb8e-4f9c-a053-33400cde9062", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa6af42-88ee-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756921891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756921891, "uuid": "8a97a35d-7524-48ba-86b2-a5e23a88e245", "comment": "Malware payload", "value": "660f6d7b790c2188dd7bd6c0c80e5293", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756921891, "uuid": "c3e7d2ab-dade-41d4-a7e1-7262c3344b98", "comment": "Malware payload", "value": "fe3c13f85b4d4e938be59b6444fb0346750a31fb5829880b5349174033fc4aa4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756921891, "uuid": "bfed8093-a71f-4950-8aef-0894dbe6fefe", "comment": "Malware payload", "value": "fd9483b5938f8431807bc170938475776457db55", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756921891, "uuid": "8b79befe-6075-449d-82f9-7b394d8090e2", "comment": "Malware payload", "value": "668638daabdb0be0f8440aff8a6e5484c2640f1666977e579cb5a5675a6ba6fa7eb96aef1003b0ef695c20a516935e66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756921891, "uuid": "30a950fc-339e-48e3-8e1c-e3cb02f9274b", "value": "T14C2385C87DC77451C287023E3C6F499AFAEA5CD0091ED868F305E8A07D2547DABB29D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756921891, "uuid": "529a575f-8f1b-4396-9c5d-cc8a9b58fd18", "value": "1536:hD3C6g4FgfKNeu7vC6zUadXL11G1YObBuG:hD3rg4KKeCPzUadXL/G15/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756921891, "uuid": "b6aad944-3aa3-4a74-8b4f-17385cbd9ea4", "value": 50010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756921891, "uuid": "3684216b-8068-41f9-bfcb-c0338ecb0b9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756921891, "uuid": "ede4e13e-f42e-4690-892b-8fd333ac5acc", "value": "Updater_31718.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6c6065-88ef-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1756922259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922259, "uuid": "c934d6f6-3da3-4a2f-92d2-57c8ba2d4a67", "comment": "Malware payload", "value": "e29328cd54ee39510997f63038644123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922259, "uuid": "032913ac-9b7f-4d45-be6f-8fffd1489f67", "comment": "Malware payload", "value": "fe788b4069140e15ef9e40e1195ae701db1d7b555e95689767fe3d1c041e5e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922259, "uuid": "43271af9-5726-43eb-8789-5cadc48f7672", "comment": "Malware payload", "value": "809adbc20f5ea2fb4dee4da72329f5c4f298c85d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756922259, "uuid": "458a2024-ad25-47f2-98bd-0b4d6ce87694", "comment": "Malware payload", "value": "ba23d9a9dc998bfab14a99855bcc8b89e9f4240818461ee026506e9ac872198f31dc2be0d21a5e28459a96e52ce3c525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922259, "uuid": "9619951f-1d2d-4bf0-a9c1-138b118e6ee1", "value": "T1A803F156F1888A3FCCF685783656A15743EF7444CF3BEB7D241E2C29DC26952CAC850A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922259, "uuid": "2710f60e-3ccf-472e-8e2b-22064f27f3e0", "value": "59e82f568be780decbf635ea2d441bda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922259, "uuid": "764bad44-c8ce-4f5a-bb49-8d3d8fd52427", "value": "768:2FciyXcExN8X8fDtyEFk2fialc32r1LrhIOdlyfSRzXlm4zoRH:2FciyXcExL0EFkmlc3SLj3FRz8woRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756922259, "uuid": "9a7e3284-da2f-4de5-a0f6-83a4a13a540f", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756922259, "uuid": "175cc6fc-bab6-4290-8c85-f8b140d9912b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756922259, "uuid": "b37b33ae-372b-4e4a-bbeb-939fd6d19f8d", "value": "e29328cd54ee39510997f63038644123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb367d4-88bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1756901597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901597, "uuid": "d1c978dc-f477-4230-8851-93d939c46c5d", "comment": "Malware payload (GCleaner)", "value": "23164c32b7b07284e25b695005544b53", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901597, "uuid": "b9484522-92fd-4dae-b6a1-933ab36bf574", "comment": "Malware payload (GCleaner)", "value": "fea6875b7e1c0ad8ac615f9d92213b8a9947182dce38c48f2a2e4362acb1a761", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901597, "uuid": "17f7f5d8-855b-4c6d-ac70-c59a0df33fbe", "comment": "Malware payload (GCleaner)", "value": "e2def0b289d4179d221a3fba56b454fb0851761e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756901597, "uuid": "7f53e311-c1e4-41ee-8d0a-35cf1b7a0609", "comment": "Malware payload (GCleaner)", "value": "4f5e70b99ced9255cabbf52f30f9688c2a5bf195ec15fa03ce9283ece05dbb12805446f0352ba5fe9df233558094ef1b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901597, "uuid": "bca0e513-c098-4074-810a-c9b75d9a4518", "value": "T1B906E152A361CB3AF03E63FDFC2699FF48F9B5512C38A8564F9117B59B342E06938112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901597, "uuid": "01b4b914-6875-48aa-8854-ea45f8402299", "value": "bd46f408207f13baa837940df074f4e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901597, "uuid": "ec06e16c-b95a-454d-ab4d-2fe91a75fdb5", "value": "49152:qorVR22rLndJv+UCuHIZM+RgEGWa5jzoXbrgkbInx1TDg42asExcNm8pyeBAU5Wc:qorxrdJ2/PWgrXIxeUxxcHTMsp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756901597, "uuid": "ebbf518a-863f-4f18-98df-e4dc423687c9", "value": 3795744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756901597, "uuid": "641b3071-b4a3-4e6c-8e51-10674418ed51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756901597, "uuid": "cd72fcc0-e4a3-475f-88cf-ad051a57bd0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787983b5-8901-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756929985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929985, "uuid": "2782ac2a-1e0c-4cd6-b25a-9e7f61244c35", "comment": "Malware payload (Mirai)", "value": "09900ac1a81f660ae7ca947248601236", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929985, "uuid": "a44ddf80-348b-4dbe-af65-f18eac31c1f5", "comment": "Malware payload (Mirai)", "value": "ff04a0f199ea72e1dcff502ac090767f0e3369760ee4363643d862cb424fa54e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929985, "uuid": "1799d5fc-f25c-4df8-8740-a3d31dfda8f9", "comment": "Malware payload (Mirai)", "value": "36032e979f3f6f30fc054b5b28e3235f924ab3ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756929985, "uuid": "ae9d0d2f-9cc3-404b-920c-201ddf63fe9b", "comment": "Malware payload (Mirai)", "value": "8b123965517d5b36b2e55365a1fc0469563aacda3d337480b7ee9c4ad6f83c225310f40c951e8a2b5989b5ff775fe7bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929985, "uuid": "372ca9a1-fc3a-4c45-9952-93786ae8b9e5", "value": "T126531791BCD28A12C6D462B6FA2E418D332663E8D1DF3207DD216F1177CA82F0D7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929985, "uuid": "70544f04-afd9-441c-8d9c-6bb3c5635444", "value": "1536:hQXM2XB+pVg6j8l2BK7E2VrL2yBCtt5Kvzx1B:h6P+pVoNlvYbKvzxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756929985, "uuid": "62403f00-1217-4edb-a14e-9a65b0b8dc68", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756929985, "uuid": "97855cb5-9552-4b39-a111-52f2ee3247e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756929985, "uuid": "5dd73f9d-7e48-48e4-81ac-1b025e2a70dc", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c219fc23-8872-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1756868691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868691, "uuid": "08ce1795-f8c3-4d59-93ba-07fa764e49d3", "comment": "Malware payload (Mirai)", "value": "5c794a3ae9c96e4c217cd2cc73ad330d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868691, "uuid": "aae2c75e-d336-4b19-801a-b575110088c8", "comment": "Malware payload (Mirai)", "value": "ffbe0169bc4929b9956110b0749641a03e22c8c8895a9a126358b717ed11f6c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868691, "uuid": "94172946-b454-4ea0-a611-072f4f0a6fa9", "comment": "Malware payload (Mirai)", "value": "f51e40b35b2a4f311127b807ee90691b5d5be96c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756868691, "uuid": "c348a215-a5b5-448c-a79f-d35a74c04a74", "comment": "Malware payload (Mirai)", "value": "bd2b555b9597877c3b365ca679826b7cbf4f8f8a7065ccf1344b3ddd70c8cccfdc65b28948885254d3335221610ac39c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868691, "uuid": "f2594880-e3f0-46bf-9f6d-7307e2155fee", "value": "T11F631B88F58BC5F6D80B1974806BF23F9B31C9290161E35EDF46EE75CE33646921A24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868691, "uuid": "cef2a466-8ed6-4576-a8e6-b41cac4718d5", "value": "1536:obohg74upoFalvMEjzXClCbWs31KQL1gsT:Zg74/FalvRjDCeWslT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756868691, "uuid": "5340122e-bc80-4f9c-806d-5af6707423ae", "value": 66960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756868691, "uuid": "077c7a93-3274-416d-845e-3660adc6ea25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756868691, "uuid": "a4133588-ad58-49a5-96db-378521a11bdc", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcf18c3-88ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1756894161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894161, "uuid": "092970b5-0296-44c1-8b34-f0829f6c1007", "comment": "Malware payload (RemcosRAT)", "value": "47e53266195eef742eb4656eb1f36c43", "object_relation": "md5", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894161, "uuid": "005ab889-3ac4-4ad2-bddc-9c68271a4579", "comment": "Malware payload (RemcosRAT)", "value": "ffec6638a87befb22b2bd999024bc8f7533e82a5e5b8a865643eb901b084589a", "object_relation": "sha256", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894161, "uuid": "28f6c18d-2014-4049-ac8a-f6b475ee678a", "comment": "Malware payload (RemcosRAT)", "value": "9de738e5954d7bd125db525e58d5f61591d4cef2", "object_relation": "sha1", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1756894161, "uuid": "abf0858d-b9d3-4e1f-bbd5-9f10c8946577", "comment": "Malware payload (RemcosRAT)", "value": "04bceeb6f96cab769f94869ee85d036cfe425272bca5f0b24b78baa9f567622678fad4b9bf46336857cba38b399afb84", "object_relation": "sha3-384", "Tag": [ { "name": "primeline-it-com", "colour": "#403A96", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894161, "uuid": "aef25787-4eb7-4def-a7f5-6f14812340dc", "value": "T1FFB2F180C0D7EE7CD55667925F91ACF28E4CAF95D0F907F1196AC2C2B2DC5E4E600CAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894161, "uuid": "360bab71-636d-4de8-b8de-0fdaa838e74e", "value": "768:B1OQ9M2Xxvq428zfRNANz+djWDJHqOVFPwTw:Bsdqj28zfTANz+ZWDJH5wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1756894161, "uuid": "94bbb171-5ba7-42e4-b0bc-85dca3ec89fa", "value": 25025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1756894161, "uuid": "0aa8e318-cc3e-4a5d-9594-b207c87cd848", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1756894161, "uuid": "1db082b1-1d5e-4a58-962e-0a100697eb71", "value": "RE RFQ Resend Doc2805079915 .rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }